An OS command injection flaw exists in the firmware update mechanism of Copeland XWEB Pro devices, specifically for versions 1.12.1 and earlier. The defect allows an attacker who can authenticate to the device to inject malicious shell commands through the devices field during a firmware update request. Successful exploitation grants the attacker remote code execution privileges on the affected system, enabling full control over the device and potential propagation to other network resources.

The vulnerability impacts Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO models. All listed devices running firmware versions 1.12.1 or older are affected. The vulnerability is tied to the firmware update feature provided in the device’s management interface.

The CVSS score of 8.0 highlights significant severity, but the EPSS score of less than 1% indicates that the likelihood of exploitation is low under current conditions. The vulnerability is not catalogued in CISA’s KEV list, which further suggests limited observed exploitation. Attackers would need valid credentials and likely physical or network access to the device’s configuration interface to trigger the injection. The absence of a public exploit does not diminish the importance of remediation, given the remote code execution potential.