Unauthenticated Arbitrary File Write in Dixell/Copeland XWEB EVO

CVE-2026-124014

What is CVE-2026-124014?

Dixell/Copeland's XWEB EVO versions 4.3.0 to 5.8.8 are exposed to an unauthenticated arbitrary file write vulnerability, allowing remote attackers to manipulate critical system configuration files. An exploit can replace configuration parameters such as model and plugin types through prolonged POST requests to config.lua, entirely sidestepping session validation protocols. This flaw could lead to detrimental configuration alterations and a potential denial of service as users might trigger a SYSTEM_NOT_CONFIGURED state. The product line officially reached its end of service in March 2026, making remediation vital for current users.

References