{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-124002","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","state":"PUBLISHED","assignerShortName":"VulnCheck","dateReserved":"2026-11-06T18:38:38.543Z","datePublished":"2026-11-12T19:34:26.958Z","dateUpdated":"2026-11-13T14:44:18.509Z"},"containers":{"cna":{"providerMetadata":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-11-13T14:44:18.509Z"},"title":"Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username","descriptions":[{"lang":"en","value":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026."}],"tags":["unsupported-when-assigned"],"datePublic":"2026-11-12T00:00:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","cweId":"CWE-78","type":"CWE"},{"lang":"en","description":"Missing Authentication for Critical Function","cweId":"CWE-306","type":"CWE"}]}],"affected":[{"defaultStatus":"unaffected","vendor":"Copeland","product":"XWEB EVO","versions":[{"status":"affected","version":"5.2.3","versionType":"semver","lessThan":"5.7.0"},{"status":"unaffected","version":"5.7.0","versionType":"semver"}]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","version":"3.1","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"references":[{"url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate","name":"Software Download","tags":["patch","product"]},{"url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf","name":"End of Support Announcement","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username","name":"VulnCheck Advisory: Dixell/Copeland XWEB EVO Pre-Authentication OS Command Injection via Username","tags":["third-party-advisory"]},{"url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root","name":"VulnCheck Blog","tags":["exploit","technical-description"]}],"credits":[{"lang":"en","value":"Valentin Lobstein (Chocapikk)","type":"finder"}],"timeline":[{"time":"2026-10-19T16:39:00.000Z","lang":"en","value":"VulnCheck CVD team reported to Copeland PSIRT"},{"time":"2026-10-19T17:11:00.000Z","lang":"en","value":"Copeland PSIRT acknowledged receipt"},{"time":"2026-11-05T19:13:00.000Z","lang":"en","value":"Copeland PSIRT follows up stating that given the EOS status, they will not be carrying out a comparative analysis against previously disclosed vulnerabilities"}],"x_generator":{"engine":"vulncheck"}}}}