Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
XWEB Pro 1.12.1 and prior: Malicious Commands Can Be Injected
CVE-2026-25721
Summary
An attacker can inject malicious commands into XWEB Pro's restore feature, allowing them to execute code on the system. This is a serious risk because an attacker can take control of the system, potentially causing data loss or disruption. To protect yourself, update to the latest version of XWEB Pro immediately.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| copeland | xweb_300d_pro_firmware | <= 1.12.1 | – |
| copeland | xweb_500d_pro_firmware | <= 1.12.1 | – |
| copeland | xweb_500b_pro_firmware | <= 1.12.1 | – |
Original title
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input ...
Original description
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the server username and/or password
fields of the restore action in the API V1 route.
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the server username and/or password
fields of the restore action in the API V1 route.
nvd CVSS3.1
8.8
Vulnerability type
CWE-78
OS Command Injection
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-05... Third Party Advisory
- https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate Product
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 Third Party Advisory US Government Resource
Published: 27 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026