External risk intelligence

XWEB EVO Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-124010

The vulnerability exists in a CGI script (xwconsole.cgi) within a product line that functions as a monitoring and control gateway/appliance. As an internet-facing management and control service designed for remote access, this surface is typically exposed to the public internet by design to enable remote management of connected systems.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the XWEB EVO product line, specifically within the xwconsole.cgi script, allows for unauthenticated remote attackers to execute arbitrary commands. While this product line has reached its end of service, any remaining systems could be at risk of full compromise.

Unauthenticated attackers can run any command remotely.
Confirm relevance as the product is past its service date.
Understand potential legacy exposure and risk.

Attack Path

How an attacker could exploit the issue

Attackers can reach and trigger this vulnerability by sending specially crafted input to a CGI script exposed on the network. This script, intended for system console access, does not properly validate user-provided data before passing it to a system command, allowing an attacker to inject and execute arbitrary commands with root privileges.

Unauthenticated remote access required.
Malicious input to `sh` parameter.
Full system compromise is the risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary commands as root on affected systems, potentially leading to full system compromise. The product line is past its end-of-service date, meaning it may no longer receive security updates.

System commands could be executed as root.
Malicious input via a CGI script may lead to compromise.
Full system compromise could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The XWEB EVO product line, which has reached its end of service, contains a critical command injection vulnerability. Given its role as a remote management and control gateway, it is likely exposed externally. Teams responsible for infrastructure, security, and potentially vendor management should prioritize identifying all instances of this product, assessing their reachability and business criticality, and confirming ownership to plan remediation.

Ownership rests with infrastructure and security teams.
Verify external reachability and business criticality first.
Plan remediation based on identified system owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XWEB EVO?

XWEB EVO is a monitoring and control gateway appliance designed to manage connected systems, often used in industrial or commercial cooling environments. These devices act as centralized controllers that allow operators to remotely oversee and adjust equipment performance. Because they serve as management interfaces, they are often deployed in configurations that provide remote access to system settings.

How does CVE-2026-124010 allow command injection?

This vulnerability, classified as CWE-78, occurs because the system's xwconsole.cgi script improperly handles user input. When an attacker sends specially crafted data to the 'sh' parameter, the application fails to sanitize that input before passing it to a system command. Because the script runs with root privileges, this allows an attacker to execute their own unauthorized commands on the underlying operating system.

What triggers this security flaw?

An attacker triggers this vulnerability by sending a malicious request to the xwconsole.cgi script over the network. No authentication is required to initiate this process. Importantly, the flaw is specific to the handling of the 'sh' parameter; requests that do not target this specific parameter or the vulnerable CGI script do not trigger this command execution path.

Is my XWEB EVO device at risk?

According to Halo Surface Signal, this vulnerability is considered highly relevant because XWEB EVO is a gateway designed for remote management, making it frequently exposed to the public internet by design. If your device is reachable from the internet, it is at higher risk. Even if used internally, any entity with network access to the device could potentially exploit the script to gain full system control.

How should I respond to this threat?

Since the XWEB EVO product line reached its end-of-service date in March 2026, security updates are no longer being provided. Your first step should be to inventory your network to identify all active XWEB EVO units. Once identified, evaluate their exposure level and business criticality to determine if they can be isolated from the network or decommissioned, as formal vendor patches are unlikely.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.