{"id":"EM-20261113-G90T","url":"https://cyber.eventmonitor.net/incident/EM-20261113-G90T/critical-xweb-evo-vulnerability-cve-2026-124010/","type":"cve","title":"Critical XWEB EVO Vulnerability (CVE-2026-124010)","subtitle":"CVE-2026-124010","subject":"CVE-2026-124010","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-13T00:00:00.000Z","firstSignal":"2026-11-12T20:18:24.263Z","lastSignal":"2026-11-13T00:00:00.000Z","updated":"2026-11-13T05:31:37.852Z","revision":1,"life":[{"status":"Born","at":"2026-11-13T00:00:00.000Z","why":"second independent source: C30 VulnCheck KEV"},{"status":"Developing","at":"2026-11-13T00:00:00.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-12T20:18:24.263Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-13T00:00:00.000Z","what":"Born: second source, C30 VulnCheck KEV. Page EM-20261113-G90T created."}],"stages":[{"name":"Disclosed","at":"2026-11-12T20:18:24.263Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-12T20:18:24.263Z","detail":"CVSS 9.3"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-12T20:18:24.263Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-124010 (CVSS 9.3)","text":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124010"},{"at":"2026-11-13T00:00:00.000Z","source":"C30","sourceName":"VulnCheck KEV","role":"Research & News","severity":3,"title":"CVE-2026-124010 known exploited (VulnCheck KEV): Improper Neutralization of Special Elements used in an OS Command","text":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to…","url":"https://vulncheck.com/browse/cve/CVE-2026-124010"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-12T20:18:24.263","score":9.3,"severity":"CRITICAL","desc":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to…","product":"","seen":1794530417050},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}