XWEB EVO (4.3.0 - 5.8.8) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xweb-evo-4.3.0---5.8.8/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 22:51:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXWEB EVO: Unauthenticated Arbitrary File Write (CVE-2026-124014)https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124014/Thu, 12 Nov 2026 22:51:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124014/XWEB EVO versions 4.3.0 through 5.8.8 are vulnerable to unauthenticated arbitrary file write via crafted POST requests, enabling configuration tampering or denial of service.XWEB EVO versions 4.3.0 through 5.8.8 contain an unauthenticated arbitrary file write vulnerability (CVE-2026-124014). Attackers can send a crafted POST request to config.lua with action=set to overwrite the system configuration file /etc/xwebconfig.json. The application performs no session validation, allowing unauthenticated modification of configuration values, such as model and plugin fields, or the corruption of system state to trigger a SYSTEM_NOT_CONFIGURED status. This product line reached its end-of-service date in March 2026.

Impact

Successful exploitation allows remote, unauthenticated attackers to tamper with system configurations or cause a denial-of-service condition by forcing the system into an unconfigured state.

Recommendation

  • Inventory all deployments of XWEB EVO in your environment.
  • Because this product has reached its end-of-service date as of March 2026, prioritize decommissioning these devices or isolating them from all network access immediately.
  • Implement strict network access control to prevent any external or unauthorized internal access to the configuration interface (config.lua).
]]>mediumadvisory