External risk intelligence

XWEB EVO Pre-Authentication OS Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-124007

The vulnerability affects login interfaces, including login.lua and api.lua, which are core components of web-based management portals. These interfaces are designed to be accessible for remote authentication and administration, making them public-facing by design in typical deployments of this product line.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in XWEB EVO, a product line that has reached its end of service. The issue allows unauthenticated remote attackers to execute arbitrary commands, potentially leading to root-level access by exploiting the password field during login. While the product is no longer supported, confirming its presence and potential exposure within the environment is important for risk assessment.

Unauthenticated attackers can run commands.
Product is past its end of service.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a pre-authentication OS command injection vulnerability in the password field of certain web interfaces. By manipulating the password input with shell metacharacters, an attacker can trick the system into executing arbitrary commands with root privileges when processing the password for hashing. This occurs due to improper handling of the password value before it's used in a command.

Attacker needs network access.
Attacker injects commands into password field.
Attacker achieves root command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to execute arbitrary commands with root privileges on affected systems. This occurs when an attacker injects shell metacharacters into the password field, which are then processed by the system's login scripts. The product line has reached its end of service, meaning no further security updates are expected.

System data and user data could be affected.
Injection via the password field during login.
Root-level command execution, impacting system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that XWEB EVO reached its end of service in March 2026, the immediate practical move is to identify all instances of this product line within your environment. Since it's an end-of-service product, vendor-provided fixes are unlikely, necessitating a focus on containment and risk reduction strategies. Ownership will likely fall to the team managing the operational technology or industrial control systems where XWEB EVO was deployed, in coordination with network and security teams to assess and limit exposure.

Operational Technology or System owners.
Confirm all XWEB EVO instances.
Isolate or disable affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XWEB EVO?

XWEB EVO is a series of monitoring and control systems typically used to manage refrigeration and industrial HVAC infrastructure. It provides web-based portals for administrators to configure and oversee operational technology environments. Because these devices often serve as gateways for facility management, they are frequently integrated into local networks to enable remote site supervision.

What is the vulnerability in CVE-2026-124007?

This vulnerability is an OS command injection, classified as CWE-78. It occurs when a program passes unsanitized user input—in this case, the password field—directly to a system shell. By including shell metacharacters in the input, an attacker can trick the system into executing unauthorized commands. Because the affected scripts run with elevated privileges, the attacker gains root-level control over the device.

How is this vulnerability triggered?

An attacker triggers this by submitting specific shell commands within the password field of the web-based login interface. This works because the system fails to escape the input before processing it during authentication. Importantly, this attack does not require any valid user account or prior session; it is a pre-authentication issue that targets the application logic handling the initial login request.

Is my XWEB EVO device relevant here?

If your device is reachable from an external network, it is at higher risk. Halo Surface Signal identifies that login interfaces like login.lua and api.lua are core components designed for remote administration, meaning they are often exposed to the internet. Even if a device is on an internal network, it remains susceptible to any actor who has established a foothold elsewhere in your infrastructure.

What should I do if I run XWEB EVO?

Because the product reached its end of service in March 2026, you cannot expect security patches. First, locate all instances within your environment. Once identified, the most effective practical response is to isolate these systems from the network or disable their remote management features to prevent unauthorized access. Coordinate with your operational technology team to plan for eventual replacement.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.