An OS command injection vulnerability exists in Copeland XWEB Pro firmware up to and including version 1.12.1. The flaw allows an attacker who is authenticated to the device to inject arbitrary operating‑system commands through the devices field of the firmware update apply action, leading to remote code execution on the host. This weakness is classified as a CWE‑78 path‑leading command injection and could compromise confidentiality, integrity, and availability of the system if exploited.

Affected products include Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO. All firmware revisions up to and including 1.12.1 are vulnerable; newer releases are not explicitly listed as affected.

The CVSS score of 8.0 indicates a high severity vulnerability, while the EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation. The vulnerability is not in CISA’s KEV catalog. Exploitation requires valid credentials and access to the firmware update interface, implying an authenticated remote attack vector. Once the command injection is triggered, the attacker can execute arbitrary commands with the privileges of the device, potentially taking full control of the XWEB Pro system.