CVE-2026-21718 PUBLISHED

Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm

Assigner: icscert
Reserved: 05.02.2026 Published: 27.02.2026 Updated: 27.02.2026

An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor Copeland
Product Copeland XWEB 300D PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)
Vendor Copeland
Product Copeland XWEB 500D PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)
Vendor Copeland
Product Copeland XWEB 500B PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)

Solutions

Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.

Credits

  • Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-327 CWE