Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.6
XWEB Pro Firmware Update Allows Remote Code Execution
CVE-2026-25195
Summary
An attacker with an account on the system can use a fake firmware update to take control of the system. This is a serious risk because it allows the attacker to do anything they want with the system. Update to XWEB Pro version 1.12.2 or later to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| copeland | xweb_300d_pro_firmware | <= 1.12.1 | – |
| copeland | xweb_500b_pro_firmware | <= 1.12.1 | – |
| copeland | xweb_500d_pro_firmware | <= 1.12.1 | – |
Original title
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted fir...
Original description
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted firmware update file via the firmware update route.
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted firmware update file via the firmware update route.
nvd CVSS3.1
8.0
Vulnerability type
CWE-78
OS Command Injection
Published: 27 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026