An OS command injection flaw exists in Copeland XWEB Pro firmware versions 1.12.1 and earlier. By supplying malicious input in the device hostname field, an attacker who has authenticated to the system can cause the host configuration script to execute arbitrary shell commands, giving the attacker remote code execution capabilities. This is a classic privilege‑escalating flaw corresponding to CWE‑78.

The flaw affects Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO devices running firmware versions up to and including 1.12.1. No versions newer than 1.12.1 are listed as affected. The vulnerability is limited to these specific products and their build releases.

The CVSS score is 8.0, indicating high severity. The EPSS score is below 1%, which reflects a low but non‑zero probability of exploitation in the wild, and the vulnerability is not currently indexed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to authenticate to the device, which typically requires administrative credentials, and then submit a crafted hostname value. Once the device processes the hostname during setup, it runs the supplied value as an OS command, resulting in full remote compromise. Given the high impact and the need for prior authentication, the risk to unprotected devices remains significant until the firmware fix is applied.