CVE-2026-124007: Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field
XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter.
Event History
Frequently Asked Questions
Which deployments are exposed?
XWEB EVO appliances running a version earlier than 5.6.2 are affected. The vulnerable login and related request-handling code is reachable before authentication.
Does an attacker need an account or user interaction?
No. Exploitation is unauthenticated and remote, and does not require user interaction.
What level of access can successful exploitation provide?
An attacker can execute arbitrary operating-system commands as root through the setuid wlua interpreter.
What should be prioritized for remediation?
Update XWEB EVO to version 5.6.2 or later. The provided data does not identify an alternative mitigation for systems that cannot be updated immediately.