XWEB EVO 5.2.3 Through 5.8.8 (5.2.3-5.8.8) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xweb-evo-5.2.3-through-5.8.8-5.2.3-5.8.8/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 20:49:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXWEB EVO: Authenticated OS Command Injectionhttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-command-injection-cve-2026-124008/Thu, 12 Nov 2026 20:49:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-command-injection-cve-2026-124008/XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling, allowing execution of arbitrary commands with root privileges.XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling. Authenticated attackers can execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. This flaw can be exploited through the wlua interpreter to execute arbitrary commands with root privileges. The product line reached its end-of-service date in March 2026.

Impact

Successful exploitation allows authenticated attackers to execute arbitrary commands with root privileges on the affected device. The vulnerability has a CVSS v3.1 base score of 7.2.

Recommendation

Users should note that the affected product line reached its end-of-service date in March 2026.

]]>highadvisory