An OS command injection flaw exists in the XWEB Pro firmware that allows an authenticated attacker to supply malicious input in the devices field of the get setup route, leading to execution of arbitrary operating system commands. The vulnerability is mapped to CWE‑78, which denotes command injection, and can give the attacker full control over the device if exploited successfully. The description states that the flaw can result in remote code execution on the system, underscoring the high severity of the potential impact.

The affected products are Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO. The flaw exists in firmware versions 1.12.1 and earlier for each of these models. Users running those firmware releases should verify the exact build number of their device firmware and ensure it matches an unpatched version.

The CVSS score of 8.0 categorizes this vulnerability as high, while the EPSS score of less than 1% indicates a very low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. An attacker must first authenticate to the device through valid credentials, implying that compromise would most likely occur from an internal or compromised network environment. Once authenticated, the attacker can construct a malicious request to the get setup route, inject commands, and achieve execution with system privilege, potentially gaining full control over the device.