XWEB EVOに脆弱性3件、認証前RCEは修正版あり
Summary
XWEB EVOを運用する組織に関わる、認証なしでroot権限の命令実行を許す脆弱性など3件が公表されました。5.7.0以上への更新に加え、残る2件は5.8.8でも影響するため、アクセス元の制限と移行の検討が必要です。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
XWEB EVOを運用する組織に関わる、認証なしでroot権限の命令実行を許す脆弱性など3件が公表されました。5.7.0以上への更新に加え、残る2件は5.8.8でも影響するため、アクセス元の制限と移行の検討が必要です。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| CopelandXWEB EVO |
≥ 5.2.3, < 5.7.0→ 5.7.0 |
5.7.0 |
Original description The description as published by the source.
XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web nvd.nist.gov
- web github.com