An OS command injection flaw exists in Copeland XWEB Pro firmware versions 1.12.1 and earlier. An authenticated attacker can inject malicious input into the devices field when accessing the get setup route, resulting in remote code execution on the device. The vulnerability is identified as CWE‑78, a command injection weakness, and if exploited it can give the attacker full control over the operating system.

The affected products are Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO. The flaw exists in firmware versions 1.12.1 and earlier for each of these models. Users running those firmware releases should verify the exact build number of their device firmware and ensure it matches an unpatched version.

The CVSS score of 8.0 categorizes this vulnerability as high, while the EPSS score of less than 1% indicates a very low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. An attacker must first authenticate to the device through valid credentials, implying that compromise would most likely occur from an internal or compromised network environment. Once authenticated, the attacker can construct a malicious request to the get setup route, inject commands, and achieve execution with system privilege, potentially gaining full control over the device.