Critical severity9.8NVD Advisory· Published Nov 12, 2026· Updated Nov 12, 2026

CVE-2026-124010

Description

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Xweb/Xwebllm-fuzzy
Range: <5.6.2
Copeland/XWEB EVOllm-fuzzy
Range: <5.6.2

Patches

Vulnerability mechanics

References

webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdatenvd
webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdfnvd
www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cginvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000