XWEB EVO: Unauthenticated Arbitrary File Write (CVE-2026-124014)

XWEB EVO versions 4.3.0 through 5.8.8 contain an unauthenticated arbitrary file write vulnerability (CVE-2026-124014). Attackers can send a crafted POST request to config.lua with action=set to overwrite the system configuration file /etc/xwebconfig.json. The application performs no session validation, allowing unauthenticated modification of configuration values, such as model and plugin fields, or the corruption of system state to trigger a SYSTEM_NOT_CONFIGURED status. This product line reached its end-of-service date in March 2026.

Impact

Successful exploitation allows remote, unauthenticated attackers to tamper with system configurations or cause a denial-of-service condition by forcing the system into an unconfigured state.

Recommendation

• Inventory all deployments of XWEB EVO in your environment.
• Because this product has reached its end-of-service date as of March 2026, prioritize decommissioning these devices or isolating them from all network access immediately.
• Implement strict network access control to prevent any external or unauthorized internal access to the configuration interface (config.lua).