Critical OS Command Injection Vulnerability in Copeland XWEB EVO

## Overview A critical OS command injection vulnerability has been identified in Copeland XWEB EVO versions 5.2.3 through before 5.7.0. This flaw allows unauthenticated remote attackers to execute arbitrary OS commands. The vulnerability exists in the username field of login.lua, cleanout.lua, or api.lua, occurring before the password check. ## Technical Details The vulnerability, tracked as CVE-2026-124002, enables attackers to inject shell metacharacters into the username field. This can be exploited in conjunction with the setuid-root wlua interpreter. By leveraging this flaw, attackers can execute commands with root privileges, leading to full system compromise. The affected product line reached its end of service date in March 2026, which raises concerns about ongoing support and patching. ## Impact Successful exploitation of this vulnerability can result in complete control over the affected systems. Given the critical severity rating of 9.3, organizations using vulnerable versions of Copeland XWEB EVO are at high risk for unauthorized access and potential data breaches. Attackers can execute commands that may lead to data loss, service disruption, or further exploitation of the network. ## Mitigation Defenders should upgrade to Copeland XWEB EVO version 5.7.0 or later immediately to mitigate this vulnerability. Organizations should also review their security policies and practices regarding the use of unsupported software. Regularly updating and patching systems is essential to protect against such vulnerabilities.