CVE-2026-24663 - Vulnerability Details

- Copeland XWEB and XWEB Pro OS Command Injection

Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1
and prior, enabling an unauthenticated attacker to achieve remote code
execution on the system by sending a crafted request to the libraries
installation route and injecting malicious input into the request body.

Published: 2026-02-27

Score: 9 Critical

EPSS: 1.2% Low

KEV: No

Impact:

Action:

Analysis

Impact

An OS command injection flaw exists in Copeland XWEB Pro firmware versions 1.12.1 and earlier, allowing an unauthenticated attacker to execute arbitrary commands on the device by sending a crafted request to the libraries installation route. The vulnerability is a classic command injection, classified as CWE‑78, and would give the attacker full control over the operating system of the affected control device.

Affected Systems

The flaw affects Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO models. Firmware versions 1.12.1 and earlier are impacted; newer releases have received a fix from Copeland, as indicated by the vendor’s update page.

Risk and Exploitability

The CVSS score of 9.0 reflects high severity. The EPSS score of 1% indicates a low but non‑zero probability of exploitation. Since the vulnerability is exploitable from anywhere on the network and requires no authentication, the attack vector is likely remote. The flaw is not listed in CISA’s KEV catalog, but given its high CVSS and the nature of the issue, a timely patch is strongly recommended.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Copeland

Copeland XWEB 300D PRO

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.12.1

Copeland

Copeland XWEB 500D PRO

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.12.1

Copeland

Copeland XWEB 500B PRO

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.12.1

Configuration 1 [-]

AND

cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Copeland

Copeland Xweb 300d Pro

100%

Version	Status	Scheme	Platform
`[0,1.12.1]`	affected	semver	—

Copeland

Copeland Xweb 500b Pro

100%

Version	Status	Scheme	Platform
`[0,1.12.1]`	affected	semver	—

Copeland

Copeland Xweb 500d Pro

100%

Version	Status	Scheme	Platform
`[0,1.12.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.

OpenCVE Recommended Actions

Apply the latest firmware update for each affected XWEB Pro model by retrieving the package from Copeland’s software update page or initiating a network‑directed update via the device’s SYSTEM – Updates | Network menu.
Restrict external access to the libraries installation route, for example by configuring firewall rules or network segmentation so that only trusted internal IP ranges can reach the device.
If the installation feature is not required for operational purposes, disable or lock it down and enforce authentication so that only authorized users can trigger it.

Generated by OpenCVE AI on April 18, 2026 at 10:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01236.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10

History

Mon, 09 Mar 2026 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Copeland xweb 300d Pro Copeland xweb 300d Pro Firmware Copeland xweb 500b Pro Copeland xweb 500b Pro Firmware Copeland xweb 500d Pro Copeland xweb 500d Pro Firmware
CPEs		cpe:2.3:h:copeland:xweb_300d_pro:-:::::::* cpe:2.3:h:copeland:xweb_500b_pro:-:::::::* cpe:2.3:h:copeland:xweb_500d_pro:-:::::::* cpe:2.3:o:copeland:xweb_300d_pro_firmware:::::::: cpe:2.3:o:copeland:xweb_500b_pro_firmware:::::::: cpe:2.3:o:copeland:xweb_500d_pro_firmware::::::::
Vendors & Products		Copeland xweb 300d Pro Copeland xweb 300d Pro Firmware Copeland xweb 500b Pro Copeland xweb 500b Pro Firmware Copeland xweb 500d Pro Copeland xweb 500d Pro Firmware

Mon, 02 Mar 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 27 Feb 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Copeland Copeland copeland Xweb 300d Pro Copeland copeland Xweb 500b Pro Copeland copeland Xweb 500d Pro
Vendors & Products		Copeland Copeland copeland Xweb 300d Pro Copeland copeland Xweb 500b Pro Copeland copeland Xweb 500d Pro

Fri, 27 Feb 2026 01:00:00 +0000

Type	Values Removed	Values Added
Description		An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.
Title		Copeland XWEB and XWEB Pro OS Command Injection
Weaknesses		CWE-78
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

Subscriptions

Copeland Copeland Xweb 300d Pro Copeland Xweb 500b Pro Copeland Xweb 500d Pro Xweb 300d Pro Xweb 300d Pro Firmware Xweb 500b Pro Xweb 500b Pro Firmware Xweb 500d Pro Xweb 500d Pro Firmware

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2026-02-27T00:36:49.215Z

Updated: 2026-03-02T18:53:35.434Z

Reserved: 2026-02-05T16:55:52.321Z

Link: CVE-2026-24663

Vulnrichment

Updated: 2026-03-02T18:53:31.773Z

NVD

Status : Analyzed

Published: 2026-02-27T01:16:18.790

Modified: 2026-03-09T19:58:18.290

Link: CVE-2026-24663

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-18T10:30:35Z

Weaknesses

CWE-78

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object