CVE-2026-124014
Received Received - Intake

Unauthenticated Arbitrary File Write in XWEB EVO

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: VulnCheck

Description
XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-124014
EUVD
EUVD-2026-124673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Copeland XWEB EVO From 4.3.0 (inc) to 5.8.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124014 is an unauthenticated arbitrary file write vulnerability in XWEB EVO versions 4.3.0 through 5.8.8. It allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set. The vulnerability exists due to missing session validation and lack of input sanitization.

Detection Guidance

Check for unauthorized POST requests to /config.lua with action=set or action=get parameters. Inspect /etc/xwebconfig.json for unexpected modifications. Monitor for SYSTEM_NOT_CONFIGURED states or tampered model/plugin fields.

Impact Analysis

This vulnerability can allow attackers to tamper with configuration values such as model and plugin fields. It can also trigger a SYSTEM_NOT_CONFIGURED state, leading to denial of service. Since the product line reached end-of-support in March 2026, no official patches will be released.

Mitigation Strategies

Block external access to the config.lua endpoint via firewall rules. Disable unauthenticated POST requests to config.lua. Monitor network traffic for suspicious POST requests to this path. Consider isolating affected systems due to end-of-support status.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...