An OS command injection flaw in XWEB Pro 1.12.1 and earlier lets a user with authenticated access to the device supply a specially crafted template file, causing the vendor’s route handler to execute arbitrary shell commands. The vulnerability enables remote code execution, giving the attacker full control over the affected system and any connected subsystems.

The flaw affects Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO models running firmware versions up to but not including the latest released versions. All devices that are using the embedded firmware for these three hardware lines and have not applied the vendor‑provided updates are vulnerable.

With a CVSS score of 8.0 the technical severity is high, yet the EPSS indicates a very low probability of active exploitation (< 1 %). The vulnerability is not listed in the CISA KEV catalog, suggesting that known exploits are not currently widespread. Attackers must first authenticate to the system, then upload a malicious template, after which the operating system commands are executed, enabling full remote compromise. The relatively low EPSS score reflects that although the issue is severe, it requires both privileged execution and knowledge of the proprietary upload mechanism, limiting its immediate threat level.