{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xweb-evo--5.6.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124007"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XWEB EVO (\u003c 5.6.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eXWEB EVO contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached its end of service date in March 2026.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary commands as root.\u003c/p\u003e\n","date_modified":"2026-11-12T20:49:04Z","date_published":"2026-11-12T20:49:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124007/","summary":"XWEB EVO contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field.","title":"XWEB EVO: Pre-authentication OS command injection (CVE-2026-124007)","url":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124007/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-124004"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XWEB EVO (\u003c 5.6.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eXWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete administrative session and full control over the application. This product line reached its end of service date in March 2026.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account and full control over the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eAs the product has reached its end of service, users should be aware that the vulnerability persists.\u003c/p\u003e\n","date_modified":"2026-11-12T20:47:29Z","date_published":"2026-11-12T20:47:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-backdoor-cve-2026-124004/","summary":"XWEB EVO before 5.6.2 contains a hardcoded backdoor password that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account.","title":"XWEB EVO: Hardcoded administrative backdoor","url":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-backdoor-cve-2026-124004/"}],"language":"en","title":"CraftedSignal Threat Feed - XWEB EVO (\u003c 5.6.2)","version":"https://jsonfeed.org/version/1.1"}