An OS command injection vulnerability exists in Copeland XWEB Pro firmware version 1.12.1 and prior, allowing an authenticated attacker to inject malicious shell commands via the devices field in the firmware update action. Successful exploitation grants remote code execution on the affected device, providing full control over the system and potential spread to other network resources.

The vulnerability impacts Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO models. All listed devices running firmware versions 1.12.1 or older are affected. The vulnerability is tied to the firmware update feature provided in the device’s management interface.

The CVSS score of 8.0 highlights significant severity, but the EPSS score of less than 1% indicates that the likelihood of exploitation is low under current conditions. The vulnerability is not catalogued in CISA’s KEV list, which further suggests limited observed exploitation. Attackers would need valid credentials and likely physical or network access to the device’s configuration interface to trigger the injection. The absence of a public exploit does not diminish the importance of remediation, given the remote code execution potential.