An OS command injection vulnerability exists in Copeland XWEB Pro firmware versions 1.12.1 and earlier. It allows an authenticated attacker to craft a malicious LCD state that, when processed during system setup, injects operating‑system commands, giving the attacker remote code execution on the device. The flaw is a classic command injection weakness (CWE‑78).

Affected firmware is distributed to the Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO hardware lines. Users running firmware version 1.12.1 or earlier on any of these models are susceptible.

The CVSS score of 8 indicates high severity, and the EPSS score shows a very low current exploitation probability. The vulnerability has not been listed in CISA’s KEV catalog. Exploitation requires authentication and the ability to upload or configure LCD state data; once these prerequisites are met, an attacker can cause arbitrary command execution on the host operating system. The most likely attack vector involves an authenticated user with network access to the XWEB Pro, using the web interface to upload a malicious LCD configuration.