An operating system command injection flaw exists in XWEB Pro firmware versions 1.12.1 and earlier. By inserting malicious commands into the MBird SMS service URL or into code passed to the utility‑route during system setup, an attacker who has authenticated access can cause the system to execute arbitrary operating‑system commands. This leads to full compromise of the device, exposing all stored data and allowing the attacker to control the system. The weakness falls under CWE‑78, OS Command Injection.

The vulnerability affects Copeland XWEB models 300D PRO, 500B PRO, and 500D PRO. Firmware versions prior to 1.12.1 are impacted, and the affected CPE identifiers include product and firmware models for XWEB 300D PRO, XWEB 500B PRO, and XWEB 500D PRO. Users should verify the firmware version on each device; any device running an old XWEB Pro firmware is susceptible.

The CVSS base score of 8.0 reflects a high‑severity flaw with potential for complete system compromise. The EPSS score is less than 1 %, suggesting exploitation is unlikely in current threat environment, and the flaw is not listed in the CISA KEV catalog. Nonetheless, because the attack path requires authenticated remote access and involves injection of OS commands, it can lead to remote code execution. Users with devices exposed to the internet are at particular risk, so the vulnerability should be remediated as soon as practicable.