An OS command injection flaw exists in the templates route of Copeland XWEB Pro devices. An authenticated attacker who can send requests to this endpoint can inject arbitrary shell commands, which the firmware will execute with system privileges. The vulnerability is a classic instance of CWE‑78 and allows the attacker to alter the confidentiality, integrity, and availability of the affected system by running any code they choose.

Affected models include Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO. All firmware builds 1.12.1 and earlier are susceptible to this issue.

The CVSS score of 8.0 marks this as a high‑severity flaw, and although the EPSS score is below 1%, indicating a low probability of exploitation at this time, the availability of an in‑product patch and its presence in the CISA advisory imply that an attacker could still successfully exploit it. The attack requires authentication and the ability to reach the templates route; thus, threat practitioners should treat it as a high‑impact vulnerability but maintain ongoing vigilance as exploitation techniques evolve.