Dashboard / CVE-2026-124003

CVE-2026-124003

HIGH
MEDIUM Priority: 0.06 BB Relevance: 42/100
Published: 2026-11-12 Modified: 2026-11-13 First seen: 2026-11-12 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
Copeland XWEB EVO 0 < 5.6.2
Copeland XWEB EVO 0 < 5.6.2
Copeland XWEB EVO 0 < 5.6.2

References & Advisories (4)

Bug Bounty Relevance

42 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

8.5 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.69%
Raw Score 0.006860
Percentile 53.2%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links