CVE-2026-124002 is a critical (CVSS 9.8) pre-authentication OS command injection flaw in Copeland XWEB EVO 5.2.3 through versions before 5.7.0, and it can give unauthenticated remote attackers root-level control of the device.
What Is It
XWEB EVO accepts a username at login, and that field is passed into OS commands without being sanitized. An attacker can put shell metacharacters in the username field of login.lua, cleanout.lua, or api.lua. The injected commands run before the password check happens, so no valid credentials are needed.
The XWEB EVO product line includes a setuid-root wlua interpreter. Combined with that, the injection lets attackers run arbitrary commands as root, which means full system compromise.
The weaknesses are CWE-78 (OS Command Injection) and CWE-306 (Missing Authentication for Critical Function). VulnCheck assigned and disclosed the CVE.
Why It Matters
- No authentication required: the injection happens before the password is checked.
- Root-level impact: the setuid-root
wluainterpreter turns command injection into full system compromise. - Low barrier: the CVSS 3.1 vector is
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means network attack vector, low complexity, and no privileges or user interaction needed. The CVSS 4.0 score is 9.3 (Critical). - Unsupported product line: the description says XWEB EVO reached end of service in March 2026. The CVE carries the
unsupported-when-assignedtag.
At the time of writing, there is no CISA KEV entry for this CVE. The supplied data does not confirm active exploitation. The NVD record is in "Deferred" status.
What's Vulnerable
| Vendor | Product | Affected Versions | Unaffected |
|---|---|---|---|
| Copeland | XWEB EVO | 5.2.3 to < 5.7.0 | 5.7.0 |
The vulnerable endpoints are login.lua, cleanout.lua, and api.lua, through the username parameter.
Patch Status
The affected-version data lists XWEB EVO 5.7.0 as unaffected. Copeland's references include a Dixell System Software Update page (linked below). Operators running versions 5.2.3 through 5.6.x should check that page for the 5.7.0 software.
The product line reached end of service in March 2026. Organizations still running XWEB EVO should not expect further vendor support and should plan to replace it.
No CISA KEV required action or remediation due date applies, because the CVE is not in the KEV catalog.