Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route.
References (3)
Core 3
Core References
Third Party Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
Various Sources
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
Scores
CVSS v3
8.0
EPSS
0.0013
EPSS Percentile
32.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (3)
copeland/xweb_300d_pro_firmware
< 1.12.1
copeland/xweb_500b_pro_firmware
< 1.12.1
copeland/xweb_500d_pro_firmware
< 1.12.1
Published
Feb 27, 2026
Tracked Since
Feb 27, 2026