CVE-2026-124014 in XWEB EVO
Summary
by MITRE • 11/12/2026
XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/12/2026
The vulnerability identified in XWEB EVO versions ranging from 4.3.0 through 5.8.8 represents a critical unauthenticated arbitrary file write flaw that fundamentally compromises the integrity and availability of the system configuration. This security defect resides within the handling of POST requests directed at the config.lua endpoint, specifically when the action parameter is set to "set". The core technical failure stems from a complete absence of session validation or authentication checks for this specific operation. Consequently, any remote attacker with network access to the service can interact directly with the configuration interface without needing valid credentials. When an attacker sends a crafted POST request containing raw, unvalidated data in the body, the application processes this input and writes it directly into the system configuration file located at /etc/xwebconfig.json. This lack of sanitization allows for arbitrary modification of critical configuration parameters, as the software does not verify if the incoming data conforms to expected formats or authorized values before persisting changes to disk.
The operational impact of this vulnerability is severe, primarily manifesting through unauthorized configuration tampering and potential denial of service conditions. By exploiting the unauthenticated write capability, an attacker can alter essential system settings such as model identifiers and plugin configurations. These modifications can disrupt normal application behavior or introduce malicious logic into the execution environment. Furthermore, attackers can exploit the interaction between action=get and action=set operations to force the system into a SYSTEM_NOT_CONFIGURED state. This specific condition effectively renders the device inoperable for its intended purpose, creating a reliable denial of service vector that does not require brute-force attacks or resource exhaustion techniques. The ability to arbitrarily write to configuration files also opens avenues for further exploitation if subsequent processes rely on these settings for security decisions or privilege escalation paths.
From an industry standards perspective, this vulnerability aligns with CWE-434, which describes the unrestricted upload of file with dangerous type, and more accurately CWE-94, code injection via unvalidated input that leads to configuration modification. In terms of offensive cyber operations mapping, this flaw facilitates ATT&CK technique T1505.003, Server Software Component: Web Shell, if the attacker manages to write executable content or scripts into accessible directories through misconfiguration changes, although in this specific case, it primarily supports T1222.002, Linux and Mac File and Directory Permissions Modification for persistence or disruption. The lack of authentication on a critical administrative function is also indicative of CWE-306, Missing Authentication for Critical Function. Given that the product line has reached its end-of-service date in March 2026, immediate remediation through vendor patches may not be feasible. Organizations relying on these versions must implement compensating controls such as network segmentation to restrict access to management interfaces, enforce strict firewall rules limiting POST requests to trusted IP addresses only, and monitor for anomalous configuration changes via file integrity monitoring solutions.