CVE-2026-20797 PUBLISHED

Copeland XWEB and XWEB Pro Stack-based Buffer Overflow

Assigner: icscert
Reserved: 05.02.2026 Published: 27.02.2026 Updated: 27.02.2026

A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 4.3

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Copeland
Product	Copeland XWEB 300D PRO
Versions	Default: unaffected affected from 0 to 1.12.1 (incl.)

Vendor	Copeland
Product	Copeland XWEB 500D PRO
Versions	Default: unaffected affected from 0 to 1.12.1 (incl.)

Vendor	Copeland
Product	Copeland XWEB 500B PRO
Versions	Default: unaffected affected from 0 to 1.12.1 (incl.)

Solutions

Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.

Credits

Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA. finder

References

Problem Types

WE-121