CVE-2026-124010 is a critical (CVSS 9.8) command injection flaw in Copeland XWEB EVO before 5.6.2 that lets unauthenticated remote attackers run arbitrary commands as root.
What Is It
The flaw is in xwconsole.cgi, a CGI program that runs setuid-root on Copeland XWEB EVO. Input passed through the sh parameter goes straight to popen() without sanitization. A remote attacker can use this to run any command with root privileges.
VulnCheck reported the issue. NVD lists two weaknesses: - CWE-78: OS Command Injection - CWE-250: Execution with Unnecessary Privileges
Why It Matters
- No login or user action needed. The attacker needs no credentials and no help from a user. The CVSS 3.1 vector is
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8 (Critical). Under CVSS 4.0 it scores 9.3 (Critical). - Full takeover. Commands run as root, so a successful attack gives full control of the device.
- End of service. The XWEB EVO product line reached end of service in March 2026. CVE.org tagged the CVE "unsupported-when-assigned," and NVD has set its analysis status to "Deferred."
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. The source data does not confirm active exploitation in the wild.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| Copeland | XWEB EVO | All versions before 5.6.2 |
The NVD record lists no CPE matches.
Patch Status
The affected range ends before version 5.6.2, so 5.6.2 is the first version outside it. Copeland's System Software Update page is listed as a reference for obtaining updates.
Because the product line is past end of service, owners should also read Copeland's March 2026 end-of-service bulletin and plan for life after support. No CISA KEV entry was supplied, so there is no federal required action or due date for this CVE.
Recommended steps: - Upgrade XWEB EVO to 5.6.2 or later. - Confirm that XWEB EVO devices cannot be reached from untrusted networks. - Plan to migrate off the product, since it is no longer supported.