Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.
References (3)
Core 3
Core References
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
Third Party Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
Various Sources
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
Scores
CVSS v3
8.0
EPSS
0.0149
EPSS Percentile
70.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (6)
Copeland/Copeland XWEB 300D PRO
< 1.12.1
Copeland/Copeland XWEB 500B PRO
< 1.12.1
Copeland/Copeland XWEB 500D PRO
< 1.12.1
copeland/xweb_300d_pro_firmware
< 1.12.1
copeland/xweb_500b_pro_firmware
< 1.12.1
copeland/xweb_500d_pro_firmware
< 1.12.1
Published
Feb 27, 2026
Tracked Since
Feb 27, 2026