An OS command injection flaw exists in Copeland XWEB Pro firmware version 1.12.1 and earlier, allowing an authenticated attacker to embed arbitrary operating‑system commands in requests to the device’s restore endpoint. This vulnerability permits remote code execution, which can compromise confidentiality, integrity, and availability of the entire system. The weakness aligns with CWE‑78, the classic command injection category.

Copeland has disclosed that the affected products are the XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO. All firmware releases up to and including 1.12.1 are vulnerable. The vendor recommends installing the latest available firmware version through the Copeland software update portal or by using the System > Updates | Network menu on the device.

The CVSS score of 8 indicates a high severity. The EPSS score is less than 1%, showing that the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog, so no active exploits are known. Exploitation requires authenticated access and ability to send crafted requests to the restore route, which typically means the attacker must have valid user credentials and network connectivity to the XWEB Pro. Once the restore request is processed, the attacker can execute arbitrary commands and gain full control of the device.