OS Command Injection Vulnerability in Dixell/Copeland XWEB EVO

CVE-2026-124002

What is CVE-2026-124002?

The XWEB EVO product line from Dixell/Copeland, specifically versions 5.2.3 up to 5.6.9, is susceptible to a pre-authentication OS command injection vulnerability. This flaw permits unauthenticated remote attackers to execute arbitrary operating system commands by injecting shell metacharacters into the username field during the login process. By leveraging this vulnerability in conjunction with the setuid-root wlua interpreter, an attacker can obtain root privileges, potentially taking complete control of the system. Notably, this product line has reached its end of service date as of March 2026, emphasizing the urgency for users to update or replace affected systems.

References