VulnCheck says the flaw is in a privileged console CGI component. An attacker who can reach that component may execute commands as root without signing in.This identifier covers the console CGI flaw. CVE-2026-124002 describes a separate XWEB EVO issue in username handling, with a different affected range. Operators should check each advisory against the software running on their devices.
What it allows
How Does CVE-2026-124010 Affect XWEB EVO?
VulnCheck says the console CGI component passes unsanitized input into a command execution function. That component runs with elevated privileges, so an unauthenticated remote attacker can execute commands as root. The advisory describes potential full compromise of the affected system.
The practical exposure depends on whether an attacker can reach the device's management interface. Inventory reachable installations and review their network boundaries first. For prioritization across exposed assets, see the vulnerability intelligence platform.
Brandefense Blackhole counted one dark chat post matching CVE-2026-124010 from August 15 through November 13, 2026. The measured unit is a post, not an incident, and the count does not establish exploitation. CISA's November 10, 2026 KEV catalog did not list this CVE.
The vulnerability intelligence glossary explains how disclosure and exposure signals inform a remediation decision. The vulnerability management guide covers tracking and verifying that work.
Who is affected
Which Versions Are Affected by CVE-2026-124010?
VulnCheck identifies XWEB EVO versions before 5.6.2. Check the installed and running version on each EVO device, along with its model and management reachability. The advisory gives a version boundary, but it does not establish a currently supported security patch.
Copeland's March 2026 bulletin says software support for every XWEB EVO model ended on March 16. It says security patches and corrective software updates are no longer provided. Copeland recommends a transition to XWEB PRO models, with segmentation, restricted access and enhanced monitoring during the transition.
Do not treat version 5.6.2 alone as a Copeland-endorsed remediation for an unsupported device. Ask Copeland which current XWEB PRO model and migration path fit the installation. Record the current device state before planning the change.
Timeline
- 2026-03-16
Copeland ended software support for the XWEB EVO family, including security patches and corrective updates.
- 2026-11-12
VulnCheck dated its CVE-2026-124010 advisory and identified the affected XWEB EVO range.
- 2026-11-12
NVD published the CVE-2026-124010 record.
What to do
-
Inventory and contain reachable XWEB EVO devices
Identify all active XWEB EVO installations and record model, running version and management reachability. Copeland recommends network segmentation, restricted access and enhanced monitoring while planning migration.
-
Plan a supported replacement with Copeland
Copeland ended XWEB EVO software support on March 16, 2026 and recommends transitioning to XWEB PRO. Confirm the appropriate model and migration path with Copeland before changing a production controller.
-
Verify the change and continue monitoring
After replacement, confirm the installed and running model and software version, then recheck management reachability. Review relevant device and network activity for unexpected access or configuration changes.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124010?
It is command injection in a privileged XWEB EVO console CGI component. VulnCheck says an unauthenticated remote attacker may execute commands as root.
Which XWEB EVO versions does it affect?
VulnCheck lists XWEB EVO versions before 5.6.2. Inventory the running version of each device and check its management exposure.
Is 5.6.2 a supported security fix?
VulnCheck places 5.6.2 outside its affected range. Copeland ended software support for XWEB EVO on March 16, 2026 and recommends migration to XWEB PRO.
Is CVE-2026-124010 in CISA KEV?
It was absent from CISA's November 10, 2026 KEV catalog. The Brandefense Blackhole post count is a research signal, not evidence of an incident.
Sources
- Dixell/Copeland XWEB EVO Unauthenticated Command Injection via Console CGIVulnCheck
- Dixell/Copeland XWEB EVO Pre-Authentication OS Command Injection via UsernameVulnCheck
- CVE-2026-124010 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
- End of Software Support for the XWEB EVO FamilyCopeland Controls
- System Software UpdatesCopeland
