OS Command Injection Vulnerability in Dixell Copeland XWEB EVO Devices

CVE-2026-124007

What is CVE-2026-124007?

The XWEB EVO by Dixell is susceptible to an OS command injection vulnerability that can be exploited by unauthenticated remote attackers. By injecting shell metacharacters into the password field, attackers may execute arbitrary commands. This is due to the unescaped interpolation of the password value into specific Lua scripts (login.lua, cleanout.lua, and api.lua), allowing malicious actors to achieve root-level command execution through the setuid wlua interpreter. Users of impacted versions are urged to apply the latest updates to mitigate the risk.

References