{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3axwebevo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xweb:evo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-124014"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XWEB EVO (4.3.0 - 5.8.8)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["XWEB"],"content_html":"\u003cp\u003eXWEB EVO versions 4.3.0 through 5.8.8 contain an unauthenticated arbitrary file write vulnerability (CVE-2026-124014). Attackers can send a crafted POST request to config.lua with action=set to overwrite the system configuration file /etc/xwebconfig.json. The application performs no session validation, allowing unauthenticated modification of configuration values, such as model and plugin fields, or the corruption of system state to trigger a SYSTEM_NOT_CONFIGURED status. This product line reached its end-of-service date in March 2026.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote, unauthenticated attackers to tamper with system configurations or cause a denial-of-service condition by forcing the system into an unconfigured state.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployments of XWEB EVO in your environment.\u003c/li\u003e\n\u003cli\u003eBecause this product has reached its end-of-service date as of March 2026, prioritize decommissioning these devices or isolating them from all network access immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict network access control to prevent any external or unauthorized internal access to the configuration interface (config.lua).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T22:51:34Z","date_published":"2026-11-12T22:51:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124014/","summary":"XWEB EVO versions 4.3.0 through 5.8.8 are vulnerable to unauthenticated arbitrary file write via crafted POST requests, enabling configuration tampering or denial of service.","title":"XWEB EVO: Unauthenticated Arbitrary File Write (CVE-2026-124014)","url":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124014/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:xweb:evo:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}