Description
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the server username and/or password
fields of the restore action in the API V1 route.
Published: 2026-02-27
Score: 8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An OS command injection flaw exists in Copeland XWEB Pro firmware versions 1.12.1 and earlier. The flaw allows an authenticated user to inject arbitrary shell commands through the username and password fields of the restore API v1 route, leading to remote code execution on the device. The weakness is a classic command injection due to lack of proper input sanitization (CWE‑78).

Affected Systems

Copeland XWEB 300D PRO, Copeland XWEB 500B PRO, and Copeland XWEB 500D PRO devices running XWEB Pro firmware version 1.12.1 or earlier are impacted.

Risk and Exploitability

The vulnerability carries a high CVSS score of 8.0, indicating considerable severity. EPSS analysis shows a very low exploitation probability (<1%). The flaw is not listed in the CISA KEV catalog. An attacker must gain authenticated access to the device and then use the API V1 restore endpoint to supply malicious input; successful exploitation results in execution of arbitrary commands on the underlying operating system.

Generated by OpenCVE AI on April 16, 2026 at 15:40 UTC.

Remediation

Vendor Solution

Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.

OpenCVE Recommended Actions

  • Apply the Copeland firmware update to a version newer than 1.12.1 via the software update page or through the device’s network update menu.
  • If a patch cannot be applied immediately, isolate the affected devices from external networks or block the API V1 restore endpoint to remove the exposed input surface.
  • Implement strict network segmentation and firewall rules to limit access to the device’s management interface and API endpoints, ensuring only trusted hosts can communicate with the XWEB Pro.

Generated by OpenCVE AI on April 16, 2026 at 15:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 27 Feb 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Copeland xweb 300d Pro
Copeland xweb 300d Pro Firmware
Copeland xweb 500b Pro
Copeland xweb 500b Pro Firmware
Copeland xweb 500d Pro
Copeland xweb 500d Pro Firmware
CPEs cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
Vendors & Products Copeland xweb 300d Pro
Copeland xweb 300d Pro Firmware
Copeland xweb 500b Pro
Copeland xweb 500b Pro Firmware
Copeland xweb 500d Pro
Copeland xweb 500d Pro Firmware

Fri, 27 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Copeland
Copeland copeland Xweb 300d Pro
Copeland copeland Xweb 500b Pro
Copeland copeland Xweb 500d Pro
Vendors & Products Copeland
Copeland copeland Xweb 300d Pro
Copeland copeland Xweb 500b Pro
Copeland copeland Xweb 500d Pro

Fri, 27 Feb 2026 01:30:00 +0000

Type Values Removed Values Added
Description An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore action in the API V1 route.
Title Copeland XWEB and XWEB Pro OS Command Injection
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Copeland Copeland Xweb 300d Pro Copeland Xweb 500b Pro Copeland Xweb 500d Pro Xweb 300d Pro Xweb 300d Pro Firmware Xweb 500b Pro Xweb 500b Pro Firmware Xweb 500d Pro Xweb 500d Pro Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-03-02T14:28:34.930Z

Reserved: 2026-02-05T16:47:16.553Z

Link: CVE-2026-25721

cve-icon Vulnrichment

Updated: 2026-03-02T14:28:31.066Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-27T02:16:20.170

Modified: 2026-02-27T23:06:02.867

Link: CVE-2026-25721

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T15:45:16Z

Weaknesses