XWEB EVOに認証済みの攻撃者が任意のコマンドを実行できる脆弱性
Summary
XWEB EVOの5.2.3から5.8.8までに、認証を受けた攻撃者が機器上で任意のコマンドを実行できる脆弱性（CVE-2026-124008）が見つかりました。実行されるコマンドはroot権限で動くため、影響は機器全体に及びます。修正版の情報は公表されていないため、最新の情報を確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
XWEB EVOの5.2.3から5.8.8までに、認証を受けた攻撃者が機器上で任意のコマンドを実行できる脆弱性（CVE-2026-124008）が見つかりました。実行されるコマンドはroot権限で動くため、影響は機器全体に及びます。修正版の情報は公表されていないため、最新の情報を確認してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| CopelandXWEB EVO |
5.2.3 – 5.8.8→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web nvd.nist.gov
- web github.com