CVE-2026-124014

{
  "etk_id": "ETK-2026-4323",
  "cve_id": "CVE-2026-124014",
  "display_id": "CVE-2026-124014",
  "ghsa_id": "GHSA-x5q2-4j2q-cpfm",
  "euvd_id": "EUVD-2026-124673",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated configuration overwrite in Copeland XWEB EVO",
  "summary": "Copeland XWEB EVO 4.3.0 through 5.8.8 permits unauthenticated remote modification of its system configuration. An attacker able to reach the affected management service could change configuration settings or disrupt operation without a valid session.",
  "mitigation": "Restrict access to the XWEB EVO management service to trusted administrative networks using firewall rules and network segmentation. Plan to replace or migrate affected devices, as the evidence identifies no fixed release and reports the product line is out of service.",
  "vendor": "Copeland",
  "product": "XWEB EVO",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.3.0, <= 5.8.8"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "XWEB EVO",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.6571017,
  "t0_at": "2026-11-12T20:05:59.683000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T20:05:59.683000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T20:05:59.683000+00:00",
      "url": "https://github.com/advisories/GHSA-x5q2-4j2q-cpfm"
    }
  }
}