VulnCheck says a remote, unauthenticated attacker can reach command execution before the password check. The affected range starts at version 5.2.3 and ends before 5.7.0.VulnCheck describes a path from the username input to a privileged interpreter. The resulting commands may run with root privileges, giving an attacker control of the device. This is the username-handling flaw, separate from other XWEB EVO issues.
What it allows
How Does CVE-2026-124002 Work?
VulnCheck says XWEB EVO accepts specially formed username input in several components before checking the password. Shell metacharacters in that input can reach operating system command execution. Its advisory says the privileged interpreter can then let commands run as root.
An exposed management interface therefore deserves priority even without a valid account. The risk is device compromise and possible disruption of monitoring operations, based on the command execution described by VulnCheck. Brandefense recommends using the vulnerability intelligence platform to place this device alongside other urgent remediation work.
Brandefense Blackhole counted one dark chat post matching CVE-2026-124002 from August 15 through November 13, 2026. The unit is a post, not an incident, and this signal does not establish exploitation. CISA's November 10, 2026 Known Exploited Vulnerabilities catalog did not list the CVE.
For context on prioritizing this exposure, read the vulnerability intelligence glossary. The vulnerability management guide explains how to track remediation and verification.
Who is affected
Which XWEB EVO Versions Are Affected by CVE-2026-124002?
VulnCheck identifies XWEB EVO versions 5.2.3 through versions before 5.7.0. Confirm the model, installed firmware and running software on each device. Prioritize systems whose management interface is reachable from untrusted networks.
Version 5.7.0 is outside the advisory's stated affected range, but the cited Copeland download page does not identify a security fix for this CVE. VulnCheck says the product line reached end of service in March 2026. Ask Copeland to confirm the supported replacement path and applicable software before changing a production controller.
Timeline
- 2026-11-12
VulnCheck dated its CVE-2026-124002 advisory and described the affected XWEB EVO range.
- 2026-11-12
NVD published the CVE-2026-124002 record.
What to do
-
Inventory and restrict exposed XWEB EVO systems
Brandefense recommends finding XWEB EVO devices in the 5.2.3 to below 5.7.0 range. Restrict management access to trusted networks and review exposure from untrusted networks.
-
Confirm a supported remediation with Copeland
The VulnCheck advisory places 5.7.0 outside the affected range, but the cited Copeland page does not confirm a CVE-specific patch. Ask Copeland which supported software or replacement applies before deployment.
-
Verify the running version after the change
Record the version on each device before and after remediation. Confirm the running version is outside the stated affected range and recheck management reachability.
-
Review device and network activity
Brandefense recommends investigating unexpected management access, configuration changes and command execution indicators. Treat the dark chat count as a research signal, not evidence of compromise.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124002?
It is a pre-authentication OS command injection flaw in Copeland XWEB EVO. VulnCheck says it can let an unauthenticated remote attacker run commands with root privileges.
Which XWEB EVO versions are affected?
VulnCheck lists versions 5.2.3 through versions before 5.7.0. Check each device's running version and confirm a supported remediation with Copeland.
Does 5.7.0 fix CVE-2026-124002?
Version 5.7.0 is outside VulnCheck's stated affected range. The cited Copeland download page does not explicitly call it a CVE-specific fix, so confirm the upgrade path with Copeland.
Is CVE-2026-124002 known to be exploited?
CISA's November 10, 2026 KEV catalog did not list this CVE. The one matching dark chat post is a research signal, not incident evidence.
Sources
- Dixell/Copeland XWEB EVO Pre-Authentication OS Command Injection via UsernameVulnCheck
- CVE-2026-124002 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
- System Software UpdatesCopeland
