{"items":[{"id":"EUVD-2026-124635","enisaUuid":"3812ca1d-2972-3993-89f3-390a7e3cdb64","description":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 7:34:26 PM","dateUpdated":"Nov 13, 2026, 10:33:16 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-6fgf-7rxh-228q\nCVE-2026-124002\n","assigner":"VulnCheck","epss":4.9,"enisaIdProduct":[{"id":"442d6f71-4b4f-3ecd-a86f-55987dda5cfd","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"5.2.3 \u003c5.7.0"}],"enisaIdVendor":[{"id":"d105727c-79e8-3c92-aff1-b766cd40ba52","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124648","enisaUuid":"3acc5642-05f6-3a5d-9a95-a9a33b6e6a5b","description":"XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 7:44:23 PM","dateUpdated":"Nov 13, 2026, 10:33:10 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-hp68-2m45-hqr3\nCVE-2026-124006\n","assigner":"VulnCheck","epss":0.55,"enisaIdProduct":[{"id":"57f84d60-cfcc-3cc7-ba73-c3eea266ad1c","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"0 ≤5.8.8"}],"enisaIdVendor":[{"id":"4edc051e-d3ea-3832-8248-dd499a7ae009","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124652","enisaUuid":"178216f9-0703-3828-b40f-66aa0939e5be","description":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 7:58:13 PM","dateUpdated":"Nov 13, 2026, 10:33:01 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-m9wg-vhr5-756v\nCVE-2026-124010\n","assigner":"VulnCheck","epss":3.1,"enisaIdProduct":[{"id":"91c17ce0-4ec0-3352-b3cf-ae5c3ae6d1ec","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"0 \u003c5.6.2"}],"enisaIdVendor":[{"id":"6128c22b-d135-3b62-92f6-45278a454c27","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124673","enisaUuid":"875bcf6e-2bce-3578-87ee-25615ab1d124","description":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action\u003dset, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action\u003dget and action\u003dset operations, resulting in configuration tampering and denial of service. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 8:05:59 PM","dateUpdated":"Nov 13, 2026, 10:32:40 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-x5q2-4j2q-cpfm\nCVE-2026-124014\n","assigner":"VulnCheck","epss":0.73,"enisaIdProduct":[{"id":"aee4c952-6e83-37c5-9ebd-4cadc28b191d","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"4.3.0 ≤5.8.8"}],"enisaIdVendor":[{"id":"09def049-d105-3149-9ef1-999654e305bd","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124667","enisaUuid":"b89fe112-0f72-3a64-9193-aaf22a1f1be3","description":"XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 8:02:57 PM","dateUpdated":"Nov 13, 2026, 7:23:25 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"CVE-2026-124013\nGHSA-55x9-xqqc-c745\n","assigner":"VulnCheck","epss":2.79,"enisaIdProduct":[{"id":"e326f5e0-b091-3b4c-8811-977ab7a20154","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"5.6.2 ≤5.8.8"}],"enisaIdVendor":[{"id":"9108e6f6-0cce-302c-adbc-97654446901e","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124651","enisaUuid":"52ac9bf1-d77b-3d4c-b754-2ba589ce2b14","description":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 7:54:31 PM","dateUpdated":"Nov 13, 2026, 7:09:28 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-backup-lua\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-pxcj-mc47-xhg9\nCVE-2026-124009\n","assigner":"VulnCheck","epss":2.34,"enisaIdProduct":[{"id":"ff0d8b27-afdd-3ceb-a546-159d3aeaa512","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"5.2.3 ≤5.8.8"}],"enisaIdVendor":[{"id":"470f85a5-f85d-3eb6-8712-34f7ef0c569c","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124647","enisaUuid":"c74d3f2b-66b2-3717-8996-e09fe40daa06","description":"XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 7:42:31 PM","dateUpdated":"Nov 13, 2026, 7:06:31 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"CVE-2026-124005\nGHSA-xwmr-hvw2-h494\n","assigner":"VulnCheck","epss":0.55,"enisaIdProduct":[{"id":"204c23f9-1da2-3638-a182-b3a23ae19666","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"4.3.0 ≤5.8.8"}],"enisaIdVendor":[{"id":"0c3e84ff-b64c-34fc-9c0c-9120aaf126cd","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124674","enisaUuid":"f9fffcec-c089-39ba-abc9-932951296909","description":"XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 8:07:32 PM","dateUpdated":"Nov 13, 2026, 2:37:28 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-authentication-bypass-via-users-lua\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-9jf9-f234-pgj9\nCVE-2026-124015\n","assigner":"VulnCheck","epss":0.6,"enisaIdProduct":[{"id":"e55bdb06-1e28-34db-834b-046e865546f2","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"5.6.2 ≤5.8.8"}],"enisaIdVendor":[{"id":"a08c803a-e979-3688-bb35-7a463b60c63a","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124660","enisaUuid":"5472158c-34f7-3f69-9425-9dd79c31acbd","description":"XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 8:01:03 PM","dateUpdated":"Nov 13, 2026, 2:36:28 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-daily-password-authentication-bypass\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-377h-qxrj-gfvj\nCVE-2026-124012\n","assigner":"VulnCheck","epss":0.57,"enisaIdProduct":[{"id":"739b338f-cb79-32d8-9409-8f07220050ae","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"5.6.2 ≤5.8.8"}],"enisaIdVendor":[{"id":"d248fa26-4df2-3ea8-a01a-3ea8ecad6561","vendor":{"name":"Copeland"}}]},{"id":"EUVD-2026-124653","enisaUuid":"7d85a23d-56da-307f-a678-35a9962f7902","description":"XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device\u0027s eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it\u0027s end of service date in March 2026.","datePublished":"Nov 12, 2026, 7:59:37 PM","dateUpdated":"Nov 13, 2026, 2:36:10 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\nhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf\nhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua\nhttps://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root\n","aliases":"GHSA-ph6q-p974-r2rr\nCVE-2026-124011\n","assigner":"VulnCheck","epss":0.38,"enisaIdProduct":[{"id":"301bca82-37f7-3770-9758-404fbcb75ddf","product":{"name":"XWEB EVO","vendor":{"name":"Copeland"}},"product_version":"5.6.2 ≤5.8.8"}],"enisaIdVendor":[{"id":"7a730361-8ccb-36f2-9a56-550e62e1e7ff","vendor":{"name":"Copeland"}}]}],"total":14}