Product
XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling, allowing execution of arbitrary commands with root privileges.