PT-2026-146024

CVE-2026-124010

Published

2026-11-12

Updated

2026-11-13

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB EVO versions prior to 5.6.2

Description Unauthenticated remote attackers can execute arbitrary commands with root privileges by exploiting the setuid-root CGI 'xwconsole.cgi'. The issue occurs because the sh parameter is passed unsanitized to the popen() function, leading to command injection and full system compromise.

Recommendations Update XWEB EVO to version 5.6.2 or later. As a temporary mitigation, restrict access to the 'xwconsole.cgi' CGI script.

Exploitability

Exploit

Fix

Impacts

Researchers

Valentin Lobstein

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-250: Execution with Unnecessary Privileges