CVE-2026-124002

Name of the Vulnerable Software and Affected Versions XWEB EVO versions 5.2.3 through 5.6.9

Description A pre-authentication OS command injection flaw allows unauthenticated remote attackers to execute arbitrary OS commands. This is achieved by injecting shell metacharacters into the username field of the 'login.lua', 'cleanout.lua', or 'api.lua' endpoints before the password verification process. When combined with the setuid-root wlua interpreter, this allows the execution of commands with root privileges, leading to full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.