Valentin Lobstein

Control Web Panel (CWP) before webpanel version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.

Control Web Panel (CWP) before webpanel version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.

A pre-authentication OS command injection flaw allows unauthenticated remote attackers to execute arbitrary commands with root-level privileges. The issue occurs due to the unescaped interpolation of the password value into the `hashpass` invocation within the `login.lua`, `cleanout.lua`, and `api.lua` files, which is then executed via the setuid `wlua` interpreter. Attackers can trigger this by injecting shell metacharacters into the password field.

The Administrator web account is configured to use `password mode` daily password without a stored password. This occurs because the `authenticate()` function in `lualib users.lua` synthesizes the Administrator configuration without validating any stored secret. An attacker who can derive the MAC-based daily password can authenticate as an Administrator to obtain a full administrative session on the device.

An unauthenticated arbitrary file write issue allows remote attackers to modify the system configuration file `/etc/xwebconfig.json`. This is achieved by sending a crafted POST request to the `config.lua` endpoint with the `action` parameter set to `set`. The system fails to perform session validation and writes the raw, unvalidated request body to the file. Attackers can manipulate configuration values, such as the `model` and `plugin` fields, or trigger a `SYSTEM NOT CONFIGURED` state using the `action=get` and `action=set` operations, leading to configuration tampering and denial of service.

The software contains a hardcoded backdoor password that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. By using the hardcoded credential `xwebevonewgeneration` in a single request, an attacker can obtain a complete admin session and full control over the application. Additionally, the system is susceptible to a pre-authentication root Remote Code Execution (RCE), which allows an attacker to execute arbitrary code with root privileges on the server.

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026.

An authenticated OS command injection flaw exists where attackers can execute arbitrary commands with root privileges. This occurs by injecting shell metacharacters into the output device path parameter processed by `backup.lua`. The issue stems from unescaped concatenation into `mount`, `unzip`, and related shell commands executed via the wlua interpreter, specifically through the setuid `xwbackup.cgi` and `xwrestore.cgi` interfaces, potentially leading to full system compromise.

Unauthenticated remote attackers can execute arbitrary commands with root privileges by exploiting the setuid-root CGI 'xwconsole.cgi'. The issue occurs because the `sh` parameter is passed unsanitized to the `popen()` function, leading to command injection and full system compromise.

XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import preconfiguration and restore actions, where server url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.

The software contains a predictable credential generation issue that allows attackers to derive the Linux root password. This is achieved by computing a fixed prefix combined with a daily password value. For versions prior to 5.7.0, the root credential was identical across all units. From version 5.7.0 onwards, the credential remains derivable from the MAC-based daily password, enabling unauthorized root access to the underlying operating system.

A weak password generation mechanism allows remote attackers to derive the Administrator code-of-the-day password. This is possible by using only the device MAC address and the current date, as no server secret is involved in the process. Attackers can analyze the `xwpasswd` firmware binary, which serves as the password generator, to compute valid Administrator credentials offline and gain unauthorized access to the device.

XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026.

A pre-authentication OS command injection flaw allows unauthenticated remote attackers to execute arbitrary OS commands. This is achieved by injecting shell metacharacters into the `username` field of the 'login.lua', 'cleanout.lua', or 'api.lua' endpoints before the password verification process. When combined with the setuid-root wlua interpreter, this allows the execution of commands with root privileges, leading to full system compromise.

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.

The standard library `net.http` contains a TLS certificate validation bypass. This occurs because `SSLConnectConfig.validate` and `FetchConfig.validate` default to `false`, allowing TLS handshakes to complete without verifying certificates in both mbedtls and OpenSSL backends. An on-path attacker can intercept, read, or modify HTTPS traffic by presenting an expired, self-signed, wrong-hostname, or untrusted-root certificate when the client uses `http.get`, `http.post`, or `http.fetch` without explicitly setting `validate: true`.

An unauthenticated cross-site scripting issue exists in the 'templates/progress/clientside/restoreprogress.sgp' endpoint. Remote attackers can inject arbitrary JavaScript by manipulating the `mn`, `rnm`, `isRepliRestore`, `rusr`, and `rpwd` parameters, which are reflected unsanitized in the HTML response. This allows for the execution of malicious scripts in a victim's browser session, potentially leading to session hijacking or interface manipulation.

An unauthenticated cross-site scripting issue exists in the `templates/progress/serverside/serverbackupprogress.sgp` file. Remote attackers can inject arbitrary JavaScript by manipulating the `ClientName`, `BackupName`, and `grpName` parameters. These variables are interpolated without sanitization into `loadXMLDoc()` calls and reflected in `AbortBackup()` POST requests sent to the `dodeleteclientbackup.sgp` endpoint. This allows for the execution of malicious scripts in a victim's browser session, potentially leading to session hijacking or interface manipulation.

An execution after redirect issue exists in the user panel authentication flow (CWPUserIndex). This occurs because of a missing exit() call following a header('Location: ...') redirect, which allows unauthenticated attackers to bypass authentication. By sending unauthenticated requests, attackers can force the PHP engine to continue execution past the redirect and access user panel functionality that should be restricted.