XWEB EVO: Authenticated OS Command Injection
XWEB EVO versions 5.6.2 through 5.8.8 are vulnerable to authenticated OS command injection in api.lua, enabling arbitrary command execution with root privileges.
CVE search metadata
CVE search record: CVE-2026-124013. Severity: high. CVSS: 8.8. KEV: no. Product: XWEB EVO 5.6.2 through 5.8.8 (5.6.2-5.8.8). Brief: XWEB EVO: Authenticated OS Command Injection. Brief link: https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124013/
Triage facts
Revision 1- Applicability
- XWEB EVO 5.6.2 through 5.8.8 (5.6.2-5.8.8)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
XWEB EVO versions 5.6.2 through 5.8.8 contain an authenticated OS command injection vulnerability in the api.lua 'import_preconfiguration' and 'restore' actions. Unfiltered input parameters, specifically 'server_url' and associated server credentials, are concatenated into a root curl command executed via io.popen.
Impact
Successful exploitation allows an authenticated attacker to achieve arbitrary command execution with root privileges on the underlying system. This product line reached its end-of-service date in March 2026.
Recommendation
As the product is end-of-service, no security patches are expected. Organizations should isolate affected devices from untrusted networks.