An OS command injection flaw exists in the firmware update process of Copeland XWEB Pro systems. An attacker who is authenticated to the device can supply a specially crafted firmware file, causing the underlying operating system to execute arbitrary commands. The result is full remote code execution on the affected appliance. The vulnerability is specifically tied to version 1.12.1 and earlier, and relies on an insufficient validation of firmware update inputs, a classic root‑cause of CWE‑78.

The flaw affects the Copeland XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO models running firmware 1.12.1 or older. All three product lines can be updated through the Copeland software update portal or via the local SYSTEM → Updates > Network interface.

The CVSS score of 8.0 indicates high severity, but the EPSS score is below 1 %, suggesting a low exploitation probability at present. Because the exploit requires prior authentication and a crafted update file, the attack vector is likely an authenticated firmware upload over the local network or via remote update if the device is internet‑connected. The vulnerability is not listed in the CISA KEV catalog, which further reduces the perceived threat level, yet the impact of remote code execution warrants swift remediation.