CVE-2026-25085

Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value

Published Feb 27, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in
which an unexpected return value from the authentication routine is
later on processed as a legitimate value, resulting in an authentication
bypass.

Analysis

Technical impact

A fault in Copeland XWEB Pro firmware versions 1.12.1 and earlier allows an authentication bypass. The logic incorrectly interprets an unexpected return value from the authentication routine as a valid credential, enabling an attacker to gain unauthorized system access. The weakness is captured by CWE‑394.

Affected Systems

The flaw affects Copeland XWEB Pro model 300D PRO, 500B PRO, and 500D PRO when running firmware 1.12.1 or earlier. These devices run Copeland hardware with the specified firmware, and users of any of the three mentioned models are vulnerable if they have not upgraded to a later firmware revision.

Risk and Exploitability

The CVSS score of 8.6 signifies a high‑severity vulnerability with potential for significant confidentiality and integrity compromise. EPSS indicates a very low exploitation likelihood (<1 %), and the flaw is not yet listed in the CISA KEV catalog. Nevertheless, because the attack vector is network‑based authentication, an attacker with network visibility could potentially gain full control of the device. Monitoring network activity and applying the vendor‑issued patch are critical.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Copeland

Copeland XWEB 300D PRO

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.12.1

Copeland

Copeland XWEB 500D PRO

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.12.1

Copeland

Copeland XWEB 500B PRO

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.12.1

Configuration 1 [-]

AND

cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Copeland

Copeland Xweb 300d Pro

Version	Status	Scheme	Platform
`[0,1.12.1]`	affected	semver	—

Copeland

Copeland Xweb 500b Pro

Version	Status	Scheme	Platform
`[0,1.12.1]`	affected	semver	—

Copeland

Copeland Xweb 500d Pro

Version	Status	Scheme	Platform
`[0,1.12.1]`	affected	semver	—

Remediation

Vendor Solution

Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.

OpenCVE Recommended Actions

Apply the latest Copeland XWEB Pro firmware using the official software update page or by selecting SYSTEM → Updates → Network on the device when internet access is available.
If a firmware update cannot be performed immediately, restrict remote access to the device and limit authentication to trusted personnel until a patch is available.
Review authentication logs for suspicious or repeated failed attempts and adjust device hardening settings accordingly.

Generated by OpenCVE AI on April 16, 2026 at 15:45 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.756% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10

History

Mar 9, 2026 8:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Copeland xweb 300d Pro Copeland xweb 300d Pro Firmware Copeland xweb 500b Pro Copeland xweb 500b Pro Firmware Copeland xweb 500d Pro Copeland xweb 500d Pro Firmware
CPEs		cpe:2.3:h:copeland:xweb_300d_pro:-:::::::* cpe:2.3:h:copeland:xweb_500b_pro:-:::::::* cpe:2.3:h:copeland:xweb_500d_pro:-:::::::* cpe:2.3:o:copeland:xweb_300d_pro_firmware:::::::: cpe:2.3:o:copeland:xweb_500b_pro_firmware:::::::: cpe:2.3:o:copeland:xweb_500d_pro_firmware::::::::
Vendors & Products		Copeland xweb 300d Pro Copeland xweb 300d Pro Firmware Copeland xweb 500b Pro Copeland xweb 500b Pro Firmware Copeland xweb 500d Pro Copeland xweb 500d Pro Firmware

Mar 2, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 27, 2026 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Copeland Copeland copeland Xweb 300d Pro Copeland copeland Xweb 500b Pro Copeland copeland Xweb 500d Pro
Vendors & Products		Copeland Copeland copeland Xweb 300d Pro Copeland copeland Xweb 500b Pro Copeland copeland Xweb 500d Pro

Feb 27, 2026 1:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
Title		Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value
Weaknesses		CWE-394
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}`

Subscriptions

Copeland Copeland Xweb 300d Pro Copeland Xweb 500b Pro Copeland Xweb 500d Pro Xweb 300d Pro Xweb 300d Pro Firmware Xweb 500b Pro Xweb 500b Pro Firmware Xweb 500d Pro Xweb 500d Pro Firmware

Weaknesses