The vulnerability is an OS command injection flaw that allows an authenticated attacker to inject arbitrary commands into the request body sent to the contacts import route, thereby achieving remote code execution on the affected device. This can compromise the confidentiality, integrity, and availability of the device and any connected systems. The weakness is identified as CWE‑78.

The flaw affects Copeland XWEB 300D PRO, Copeland XWEB 500B PRO, and Copeland XWEB 500D PRO devices running firmware version 1.12.1 or earlier. The affected firmware is listed as copeland:xweb_300d_pro_firmware, copeland:xweb_500b_pro_firmware, and copeland:xweb_500d_pro_firmware.

The CVSS score of 8 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the general population. The vulnerability is not listed in the CISA KEV catalog. A likely attack path involves an attacker who has legitimate credentials to the device, sending a crafted request to the contacts import endpoint to execute shell commands. Successful exploitation would give the attacker full control over the device.