An authentication bypass in Copeland XWEB Pro 1.12.1 and earlier allows anyone with network access to the device to bypass login screens and execute code directly on the system. This flaw provides full control over the firmware, potentially leading to disclosure of sensitive data, modification of system parameters, or denial of service. The weakness is classified as CWE‑327, indicating a broken or risky cryptographic mechanism that underlies the authorization failure.

The affected products are Copeland XWEB 300D Pro, XWEB 500B Pro, and XWEB 500D Pro, all running firmware version 1.12.1 or earlier. Any device of these models that has not been updated to a newer firmware build is susceptible.

The vulnerability carries a CVSS score of 10, indicating a critical severity. Although EPSS indicates a very low probability of exploitation (<1%), the lack of a known exploit in public repositories and the fact that it is not listed in the CISA KEV list suggests it is not currently actively exploited. The likely attack vector is network‑based; an attacker can send crafted requests to the device’s service to trigger the authentication bypass and execute arbitrary code. Because the bypass eliminates the need for credentials, the threat remains for any user who can reach the device over its network interfaces.