External risk intelligence

XWEB EVO Pre-Authentication OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-124002

The vulnerability exists in the login and API endpoints of an appliance intended for remote management and monitoring. These interfaces are designed to be public-facing or internet-accessible by default to facilitate remote access, and the flaw is exploitable without authentication, placing it directly on the internet-exposed edge.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A pre-authentication vulnerability in XWEB EVO software allows unauthenticated remote attackers to execute arbitrary commands with root privileges by injecting malicious input into the username field. This could lead to a full system compromise. However, the affected product line reached its end-of-service date in March 2026, meaning it is no longer supported by the vendor.

Flaw lets unauthenticated users run commands.
Affects unsupported product, check relevance now.
Focus on identifying exposure of old systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted commands through the username field during the login process. This bypasses the need for authentication and allows for the injection of malicious operating system commands, which are then executed with root privileges due to the system's interpreter configuration.

No authentication required to access.
Inject shell commands via username field.
Achieve full system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary operating system commands with root privileges on the affected system. This could occur when an attacker crafts a malicious username with shell metacharacters, which is then processed by the vulnerable login or API scripts. The system is end-of-service, meaning it may not receive security updates.

System with root privileges.
Via crafted username on login/API.
Full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The unauthenticated OS command injection vulnerability in XWEB EVO impacts systems that are likely managed by infrastructure or platform teams, given its role in remote management. Since this product has reached its end of service, immediate patching may not be feasible, necessitating a focus on identifying all deployed instances, assessing their business criticality and exposure, and determining accountability before planning any remediation or mitigation.

Own the issue, confirm asset ownership.
Verify reachability and business criticality.
Plan risk reduction and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XWEB EVO software?

XWEB EVO is a monitoring and management appliance used for controlling various connected systems, often found in industrial or facility management settings. It provides interfaces for administrators to oversee operations remotely. Because these units handle sensitive control functions, they are designed to communicate across networks, acting as a central gateway for facility data.

What is the weakness class for CVE-2026-124002?

This vulnerability is classified as OS Command Injection. In plain terms, the software fails to properly filter input, allowing an attacker to insert special command characters into the username field. Instead of just treating the input as a name, the system mistakenly executes it as a system-level instruction. Because of how the internal interpreter functions, these commands run with the highest possible authority, known as root.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with specific login or API pages and entering a username containing shell metacharacters. The vulnerability is unique because it occurs before any password check, meaning no valid credentials are required to initiate the attack. Crucially, simply navigating to the login page without submitting this specifically crafted input does not trigger the execution.

Is my XWEB EVO system at risk?

According to Halo Surface Signal, this vulnerability is particularly concerning because XWEB EVO units are often placed on the internet-exposed edge to enable remote management. If your appliance is accessible from the internet rather than restricted to an internal, private network, it is at significantly higher risk. You should prioritize verifying if your instance is reachable from outside your local network.

What should I do if I run XWEB EVO?

Since this product reached its end of service in March 2026, it will not receive official security updates. Your first step is to identify where these units exist in your environment and determine their business criticality. Because patching is likely unavailable, focus on restricting network access to these devices—such as moving them behind a VPN—to prevent unauthorized remote access until they can be decommissioned or replaced.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.