XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Copeland
  • Xweb Evo

No data.

No data.

References
Link Providers
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate cve-icon cve-icon
https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf cve-icon cve-icon
https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-auth-os-command-injection-via-password-field cve-icon cve-icon
History

Fri, 13 Nov 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Copeland
Copeland xweb Evo
Vendors & Products Copeland
Copeland xweb Evo

Thu, 12 Nov 2026 20:15:00 +0000

Type Values Removed Values Added
Description XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.

Thu, 12 Nov 2026 20:00:00 +0000

Type Values Removed Values Added
Description XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter.
Title Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-11-12T19:48:39.316Z

Updated: 2026-11-13T00:26:01.605Z

Reserved: 2026-11-06T18:38:38.543Z

Link: CVE-2026-124007

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-12T20:18:23.387

Modified: 2026-11-13T02:18:50.883

Link: CVE-2026-124007

cve-icon Redhat

No data.