Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field
Not on CISA's list of exploited flaws, and not in the news we track.
9.2of 10, critical
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124007. Nothing runs until you send it.
XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.
You are affected if
The fix