CVE-2026-124010: Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi
XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise.
Event History
Frequently Asked Questions
Which deployments are affected?
XWEB EVO installations running a version before 5.6.2 are affected. The vulnerable component is the xwconsole.cgi CGI endpoint.
Does exploitation require credentials or user interaction?
No. A remote attacker can exploit the issue without authentication or user interaction, provided they can reach the vulnerable CGI endpoint over the network.
What level of access can an attacker obtain?
Successful exploitation allows arbitrary command execution as root because xwconsole.cgi runs with setuid-root privileges. This can result in full compromise of the affected system.
What should be prioritized for remediation?
Upgrade XWEB EVO to version 5.6.2 or later. Until upgrading is possible, restrict network access to the XWEB EVO management interface and prevent untrusted networks from reaching xwconsole.cgi.