CVE-2026-20910

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20910
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json Third Party Advisory
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
History

04 Jun 2026, 22:16

Type Values Removed Values Added
Summary (en) An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update update action to achieve remote code execution. (en) An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.

27 Feb 2026, 23:12

Type Values Removed Values Added
References () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - Third Party Advisory
References () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - Third Party Advisory, US Government Resource
First Time Copeland
Copeland xweb 500b Pro Firmware
Copeland xweb 500b Pro
Copeland xweb 500d Pro
Copeland xweb 500d Pro Firmware
Copeland xweb 300d Pro
Copeland xweb 300d Pro Firmware
CPE cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de inyección de comandos del sistema operativo existe en XWEB Pro versión 1.12.1 y anteriores, permitiendo a un atacante autenticado lograr la ejecución remota de código en el sistema mediante la inyección de entrada maliciosa en el campo devices de la acción de actualización de firmware para lograr la ejecución remota de código.

27 Feb 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 01:16

Updated : 2026-06-04 22:16

NVD link : CVE-2026-20910

Mitre link : CVE-2026-20910

CVE.ORG link : CVE-2026-20910

JSON object : View

Products Affected

copeland

  • xweb_500d_pro_firmware
  • xweb_300d_pro
  • xweb_500d_pro
  • xweb_500b_pro_firmware
  • xweb_500b_pro
  • xweb_300d_pro_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')