Copeland XWEB EVO versions 4.3.0 through 5.8.8 let remote attackers without credentials overwrite the device's system configuration file, and the product line reached end of service in March 2026.
What Is It
CVE-2026-124014 is an unauthenticated configuration write vulnerability (CWE-306: Missing Authentication for Critical Function) in Copeland XWEB EVO. The config.lua endpoint does not validate sessions. An attacker can send a crafted POST request to config.lua with action=set. The endpoint then writes the raw, unvalidated request body to one fixed file: /etc/xwebconfig.json, the system configuration file. The attacker controls what goes into that file but not where it is written. The source material does not describe writing to any other path.
The action=get and action=set operations are both reachable without authentication. Attackers can change configuration values such as the model and plugin fields. They can also force the device into a SYSTEM_NOT_CONFIGURED state.
Why It Matters
- CVSS 3.1: 9.1 (CRITICAL), vector
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 4.0: 8.8 (HIGH), from VulnCheck as a secondary score
The attack works over the network, is low complexity, and needs no privileges or user interaction. The impact is high for integrity (configuration tampering) and availability (denial of service). Confidentiality impact is rated none.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog. The source material does not confirm active exploitation.
NVD lists the record as "Deferred." VulnCheck tagged it unsupported-when-assigned, which means the product was already out of support when the CVE was assigned.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| Copeland (Dixell) | XWEB EVO | 4.3.0 through 5.8.8 |
The vendor data marks all other versions as unaffected by default. NVD lists no CPE entries.
Patch Status
The source material identifies no fixed version. According to the CVE description and Copeland's product bulletin, the XWEB EVO product line reached end of service in March 2026. Because the CVE is tagged unsupported-when-assigned, a vendor fix should not be expected.
The record does link to Copeland's Dixell System Software Update page, but the supplied data does not say whether any update there addresses this issue. Since the product is end of service, owners should plan to replace or retire XWEB EVO units. They should also check the vendor's end-of-service bulletin and the VulnCheck advisory for guidance.
CISA has issued no required action, because there is no KEV entry.