Critical 9.8

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated...

CVE-2026-124010 First seen on SecPulse 04:58

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Copeland	CopelandXWEB EVO	< 5.6.2→ 5.6.2	5.6.2

Original description The description as published by the source.

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4: Critical 9.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Published: Nov 13, 2026
First seen on SecPulse: 04:58
GHSA: GHSA-m9wg-vhr5-756v
CWE: CWE-78 CWE-250

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-78 CWE-250

All

Copeland Xweb Evo

Detection sources

NIST National Vulnerability Database06:36
GitHub Security Advisories (Global)06:31
CVE.org (CVE Program・cvelistV5)05:09