CVE-2026-25195 PUBLISHED

Copeland XWEB and XWEB Pro OS Command Injection

Assigner: icscert
Reserved: 05.02.2026 Published: 27.02.2026 Updated: 27.02.2026

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8

Product Status

Vendor Copeland
Product Copeland XWEB 300D PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)
Vendor Copeland
Product Copeland XWEB 500D PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)
Vendor Copeland
Product Copeland XWEB 500B PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)

Solutions

Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.

Credits

  • Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-78 CWE