{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xweb-evo-5.2.3-through-5.8.8-5.2.3-5.8.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-124008"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XWEB EVO 5.2.3 through 5.8.8 (5.2.3-5.8.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eXWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling. Authenticated attackers can execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. This flaw can be exploited through the wlua interpreter to execute arbitrary commands with root privileges. The product line reached its end-of-service date in March 2026.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to execute arbitrary commands with root privileges on the affected device. The vulnerability has a CVSS v3.1 base score of 7.2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUsers should note that the affected product line reached its end-of-service date in March 2026.\u003c/p\u003e\n","date_modified":"2026-11-12T20:49:13Z","date_published":"2026-11-12T20:49:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-command-injection-cve-2026-124008/","summary":"XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling, allowing execution of arbitrary commands with root privileges.","title":"XWEB EVO: Authenticated OS Command Injection","url":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-command-injection-cve-2026-124008/"}],"language":"en","title":"CraftedSignal Threat Feed - XWEB EVO 5.2.3 Through 5.8.8 (5.2.3-5.8.8)","version":"https://jsonfeed.org/version/1.1"}