An authenticated attacker can inject malicious data into the map filename field during a map upload action, allowing execution of arbitrary operating‑system commands on a Copeland XWEB Pro device. The vulnerability is classified as CWE‑78 and enables the attacker to gain remote code execution, thereby compromising the confidentiality, integrity, and availability of the device and any network it controls.

The affected products are Copeland XWEB 300D Pro, XWEB 500B Pro, and XWEB 500D Pro. Firmware versions 1.12.1 and earlier are vulnerable. Users should verify their firmware version against the list of vulnerable models provided by Copeland.

The CVSS score of 8.0 indicates high severity, while the EPSS score of less than 1% suggests a very low but nonzero exploitation probability. Attack requires authentication and the ability to trigger the upload path, reducing the likelihood of remote exploitation by unauthenticated actors but still posing significant risk if privileged credentials are compromised. The vulnerability is not listed in CISA’s KEV catalog.