XWEB EVO 5.6.2 Through 5.8.8 (5.6.2-5.8.8) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xweb-evo-5.6.2-through-5.8.8-5.6.2-5.8.8/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 20:49:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXWEB EVO: Authenticated OS Command Injectionhttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124013/Thu, 12 Nov 2026 20:49:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124013/XWEB EVO versions 5.6.2 through 5.8.8 are vulnerable to authenticated OS command injection in api.lua, enabling arbitrary command execution with root privileges.XWEB EVO versions 5.6.2 through 5.8.8 contain an authenticated OS command injection vulnerability in the api.lua 'import_preconfiguration' and 'restore' actions. Unfiltered input parameters, specifically 'server_url' and associated server credentials, are concatenated into a root curl command executed via io.popen.

Impact

Successful exploitation allows an authenticated attacker to achieve arbitrary command execution with root privileges on the underlying system. This product line reached its end-of-service date in March 2026.

Recommendation

As the product is end-of-service, no security patches are expected. Organizations should isolate affected devices from untrusted networks.

]]>highadvisory