CVE-2026-124010

{
  "etk_id": "ETK-2026-4315",
  "cve_id": "CVE-2026-124010",
  "display_id": "CVE-2026-124010",
  "ghsa_id": "GHSA-m9wg-vhr5-756v",
  "euvd_id": "EUVD-2026-124652",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Command injection in Copeland XWEB EVO",
  "summary": "Copeland XWEB EVO versions earlier than 5.6.2 are affected by command injection in the xwconsole.cgi CGI component. An unauthenticated remote attacker who can reach the vulnerable CGI endpoint may execute commands with root privileges.",
  "mitigation": "Upgrade XWEB EVO to version 5.6.2. Until upgrades are complete, restrict network access to the device and prevent untrusted systems from reaching its web interface.",
  "vendor": "Copeland",
  "product": "XWEB EVO",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 5.6.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.6.2"
      ],
      "package_name": "XWEB EVO",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 15.632092766666666,
  "t0_at": "2026-11-12T19:58:13.919000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-12T20:48:33.219225+00:00",
      "days": 0.03494560445601852,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T19:58:13.919000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-12T19:58:13.919000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T19:58:13.919000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-124010"
    }
  }
}