XWEB EVO (< 5.6.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xweb-evo--5.6.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 20:49:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXWEB EVO: Pre-authentication OS command injection (CVE-2026-124007)https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124007/Thu, 12 Nov 2026 20:49:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124007/XWEB EVO contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field.XWEB EVO contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached its end of service date in March 2026.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands as root.

]]>highadvisoryXWEB EVO: Hardcoded administrative backdoorhttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-backdoor-cve-2026-124004/Thu, 12 Nov 2026 20:47:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-backdoor-cve-2026-124004/XWEB EVO before 5.6.2 contains a hardcoded backdoor password that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account.XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete administrative session and full control over the application. This product line reached its end of service date in March 2026.

Impact

Successful exploitation allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account and full control over the application.

Recommendation

As the product has reached its end of service, users should be aware that the vulnerability persists.

]]>criticaladvisory