CRITICALCVSS v3.1 9.8Vulnerability
CVE-2026-124010
XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.03095
- Cvss score
- 9.8
- Cvss severity
- CRITICAL
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Score
- 9.8
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-124010
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-13T00:03:24+00:00
- Name
- CVE-2026-124010
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-11-12T20:18:24.263
- Last modified
- 2026-11-13T23:17:14.170
- Epss percentile
- 0.87937
Related Entities (2)
HAS_WEAKNESS (2)
Related research
Explore deeper with Ninja Signal's threat intelligence graph