A fault in Copeland XWEB Pro firmware versions 1.12.1 and earlier allows an authentication bypass. The logic incorrectly interprets an unexpected return value from the authentication routine as a valid credential, enabling an attacker to gain unauthorized system access. The weakness is captured by CWE‑394.

The flaw affects Copeland XWEB Pro model 300D PRO, 500B PRO, and 500D PRO when running firmware 1.12.1 or earlier. These devices run Copeland hardware with the specified firmware, and users of any of the three mentioned models are vulnerable if they have not upgraded to a later firmware revision.

The CVSS score of 8.6 signifies a high‑severity vulnerability with potential for significant confidentiality and integrity compromise. EPSS indicates a very low exploitation likelihood (<1 %), and the flaw is not yet listed in the CISA KEV catalog. Nevertheless, because the attack vector is network‑based authentication, an attacker with network visibility could potentially gain full control of the device. Monitoring network activity and applying the vendor‑issued patch are critical.