Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
XWEB Pro versions 1.12.1 and prior: Untrusted Input Can Execute System Commands
CVE-2026-25111
Summary
An attacker who has already logged in can execute unauthorized system commands by tricking the application into accepting malicious input. This could allow them to access sensitive data or take control of the system. If you're using XWEB Pro 1.12.1 or earlier, update to the latest version to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| copeland | xweb_500b_pro_firmware | <= 1.12.1 | – |
| copeland | xweb_300d_pro_firmware | <= 1.12.1 | – |
| copeland | xweb_500d_pro_firmware | <= 1.12.1 | – |
Original title
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input ...
Original description
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into requests sent to the restore route.
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into requests sent to the restore route.
nvd CVSS3.1
8.0
Vulnerability type
CWE-78
OS Command Injection
Published: 27 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026