{"metadata": {"vulnerability": "CVE-2026-124013", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-19T16:39:00Z", "date_only": false, "value": "2026-10-19T16:39:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.timeline.0.time", "text": "VulnCheck CVD team reported to Copeland PSIRT"}, {"timestamp": "2026-10-19T17:11:00Z", "date_only": false, "value": "2026-10-19T17:11:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.timeline.1.time", "text": "Copeland PSIRT acknowledged receipt"}, {"timestamp": "2026-11-05T19:13:00Z", "date_only": false, "value": "2026-11-05T19:13:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.timeline.2.time", "text": "Copeland PSIRT follows up stating that given the EOS status, they will not be carrying out a comparative analysis against previously disclosed vulnerabilities"}, {"timestamp": "2026-11-06T18:38:38.543Z", "date_only": false, "value": "2026-11-06T18:38:38.543Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-124013", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T20:02:57.378Z", "date_only": false, "value": "2026-11-12T20:02:57.378Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124013", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T20:10:06.208Z", "date_only": false, "value": "2026-11-12T20:10:06.208Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-124013", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T20:10:06.208Z", "date_only": false, "value": "2026-11-12T20:10:06.208Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T20:17:34.327Z", "date_only": false, "value": "2026-11-12T20:17:34.327643Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117605312352824022", "record": "CVE-2026-124013", "field": "creation_timestamp", "uuid": "03a1cacf-d564-46ac-884e-724bce283505", "content": "CVE-2026-124013 Dixell/Copeland XWEB EVO OS Command Injection via api.lua XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.\nhttps://www.cve.org/CVERecord?id=CVE-2026-124013https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdatehttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdfhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua#Copeland #XWEBEVO#CVE_2026_124013#bot", "url": "https://infosec.exchange/users/cve/statuses/117605312352824022"}, {"timestamp": "2026-11-12T20:18:25Z", "date_only": false, "value": "2026-11-12T20:18:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-55X9-XQQC-C745", "record": "GHSA-55X9-XQQC-C745", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-12T20:18:25.237Z", "date_only": false, "value": "2026-11-12T20:18:25.237", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124013", "record": "FKIE_CVE-2026-124013", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T21:31:29Z", "date_only": false, "value": "2026-11-12T21:31:29Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-55X9-XQQC-C745", "record": "GHSA-55X9-XQQC-C745", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T21:31:29Z", "date_only": false, "value": "2026-11-12T21:31:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-55X9-XQQC-C745", "record": "GHSA-55X9-XQQC-C745", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T21:36:06.743Z", "date_only": false, "value": "2026-11-12T21:36:06.743", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124013", "record": "FKIE_CVE-2026-124013", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T01:46:24.507Z", "anchors": {"origin": {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 92784.507074, "hours": 25.77347418722222, "days": 1.073894757800926, "min_seconds": 6384.507074, "max_seconds": 92784.507074, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124013", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T01:46:24.507Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}