CVE-2026-21389

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-21389
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json Third Party Advisory
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
History

27 Feb 2026, 23:12

Type Values Removed Values Added
References () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - Third Party Advisory
References () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - Third Party Advisory, US Government Resource
CPE cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*
First Time Copeland
Copeland xweb 500b Pro Firmware
Copeland xweb 500b Pro
Copeland xweb 500d Pro
Copeland xweb 500d Pro Firmware
Copeland xweb 300d Pro
Copeland xweb 300d Pro Firmware

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de inyección de comandos del sistema operativo (OS) existe en XWEB Pro versión 1.12.1 y anteriores, lo que permite a un atacante autenticado lograr la ejecución remota de código en el sistema mediante la inyección de entrada maliciosa en el cuerpo de la solicitud enviado a la ruta de importación de contactos.

27 Feb 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 01:16

Updated : 2026-02-27 23:12

NVD link : CVE-2026-21389

Mitre link : CVE-2026-21389

CVE.ORG link : CVE-2026-21389

JSON object : View

Products Affected

copeland

  • xweb_300d_pro
  • xweb_500d_pro_firmware
  • xweb_300d_pro_firmware
  • xweb_500d_pro
  • xweb_500b_pro
  • xweb_500b_pro_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')