Command Injection Vulnerability in Dixell Copeland's XWEB EVO Software
CVE-2026-124010

9.3CRITICAL

Key Information:

Vendor

Copeland

Status
Xweb Evo
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124010?

Dixell Copeland's XWEB EVO software, specifically versions earlier than 5.6.2, is impacted by a command injection vulnerability. This flaw allows unauthenticated remote attackers to execute arbitrary commands with root privileges by manipulating the unsanitized input through the sh parameter of the vulnerable xwconsole.cgi script. Successful exploitation can enable attackers to gain full control over the affected system.

Affected Version(s)

XWEB EVO 0 < 5.6.2

References

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareU...
patchproduct
https://webapps.copeland.com/dixell/Content/Pages/Adverti...
vendor-advisory
https://www.vulncheck.com/advisories/dixell-copeland-xweb...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.