An arbitrary file‑read vulnerability exists in Copeland XWEB Pro firmware versions 1.12.1 and earlier, enabling attackers that do not need any credentials to read any file on the device. The flaw can also trigger a denial‑of‑service condition by exhausting available file descriptors or corrupting critical configuration files. The weakness is a classic path‑traversal issue, identified as CWE‑22.

The vulnerability affects Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO models running firmware 1.12.1 or earlier. These industrial devices are typically deployed in control panels and network interface units within manufacturing or infrastructure environments.

The CVSS score of 3.7 indicates moderate severity, while an EPSS score of less than 1% suggests a very low current exploit likelihood. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. Based on the description, attackers can exploit the flaw remotely through the web interface without authentication. Because the impact is read‑only, the primary threat is information disclosure and possible service disruption; full system compromise would require additional weaknesses not described here.