The vulnerability is an OS command injection that allows an authenticated attacker to inject arbitrary commands into the Modbus command tool debug route parameters. This flaw can lead to remote code execution, giving attackers full control over the affected system and resulting in unauthorized data access, modification, takeover, and service disruption. The core weakness stems from insufficient input validation when processing user supplied command parameters.

The flaw affects Copeland XWEB 300D Pro, XWEB 500B Pro, and XWEB 500D Pro devices running firmware version 1.12.1 or earlier. These models are commonly deployed in industrial control environments where reliable security is essential.

The CVSS base score of 8.0 indicates a high severity vulnerability. The EPSS score of less than 1% implies that exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, exploitation requires authenticated access to the Modbus debug route, typically available to maintenance personnel over the network. If an attacker gains such access—whether through compromised credentials or an unprotected management network—they can execute arbitrary commands with the privileges of the XWEB Pro system. Given the high impact of remote code execution, the risk remains significant and warrants prompt engagement.