CVE-2026-21718

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-21718
An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json Third Party Advisory
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
History

27 Feb 2026, 23:11

Type Values Removed Values Added
CPE cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*
First Time Copeland
Copeland xweb 500b Pro Firmware
Copeland xweb 500b Pro
Copeland xweb 500d Pro
Copeland xweb 500d Pro Firmware
Copeland xweb 300d Pro
Copeland xweb 300d Pro Firmware
CWE NVD-CWE-noinfo
References () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - Third Party Advisory
References () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - Third Party Advisory, US Government Resource

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de omisión de autenticación existe en Copeland XWEB Pro versión 1.12.1 y anteriores, lo que permite a cualquier atacante omitir el requisito de autenticación y lograr la ejecución de código preautenticado en el sistema.

27 Feb 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 01:16

Updated : 2026-02-27 23:11

NVD link : CVE-2026-21718

Mitre link : CVE-2026-21718

CVE.ORG link : CVE-2026-21718

JSON object : View

Products Affected

copeland

  • xweb_300d_pro
  • xweb_500d_pro_firmware
  • xweb_300d_pro_firmware
  • xweb_500d_pro
  • xweb_500b_pro
  • xweb_500b_pro_firmware
CWE
CWE-327

Use of a Broken or Risky Cryptographic Algorithm

NVD-CWE-noinfo