An OS command injection flaw allows an attacker who is authenticated to the XWEB Pro system to send malicious input into the server username field of the import preconfiguration API V1 route. The injected payload is executed by the underlying operating system, giving the attacker full remote code execution capabilities on the device. This can result in complete system compromise, data tampering, ransomware deployment, or other destructive activities on the network where the device operates.

The vulnerability affects Copeland XWEB 300D PRO, Copeland XWEB 500B PRO and Copeland XWEB 500D PRO devices running firmware version 1.12.1 or earlier. Users should verify the installed model and firmware version against the listed vendors and ensure they are not using a vulnerable release.

A CVSS v3 score of 8 indicates high severity, while an EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the device’s API, so internal or privileged users can exploit it, highlighting the importance of strict access control. Nevertheless, once exploited, the attacker can run arbitrary commands with the privileges of the web server process, leading to full compromise.