TLS CVE-2026-24695
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into OpenSSL argument fields within requests sent to the utility route, leading to remote code execution.
AnalysisAI
Remote code execution in XWEB Pro firmware versions 1.12.1 and earlier allows authenticated attackers to execute arbitrary commands by injecting malicious input into OpenSSL parameter fields. An attacker with valid credentials can exploit this command injection vulnerability through the utility route to gain complete system compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all XWEB Pro deployments and identify systems running version 1.12.1 or prior; restrict network access to the utility route to trusted administrators only. Within 7 days: Implement WAF rules to block malicious OpenSSL argument injection patterns; disable the utility route if operationally feasible; enforce multi-factor authentication for all XWEB Pro administrative access. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today