An OS command injection flaw in Copeland XWEB Pro version 1.12.1 and earlier allows an authenticated attacker to inject arbitrary shell commands through the Wi‑Fi SSID and/or password fields. When the configuration is processed, the malicious input is executed, giving the attacker remote code execution capabilities. The weakness corresponds to CWE‑78, indicating improper validation of external input before executing system commands.

Copeland XWEB 300D PRO, Copeland XWEB 500B PRO, and Copeland XWEB 500D PRO devices running firmware version 1.12.1 or earlier are vulnerable. The issue is present in both the application and the underlying firmware of these models.

The CVSS base score is 8.0, indicating high severity, while the EPSS score is reported as less than 1 %, suggesting a relatively low chance of automated exploitation. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires an attacker to be authenticated and able to modify Wi‑Fi configuration parameters—likely through local access or a compromised user account with permission to edit the SSID/password fields. The attack surface therefore depends on the security of the device configuration interface and the compromise of valid credentials.