CVE-2026-25037

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25037
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json Third Party Advisory
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
History

27 Feb 2026, 23:07

Type Values Removed Values Added
References () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - Third Party Advisory
References () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - Third Party Advisory, US Government Resource
CPE cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*
First Time Copeland
Copeland xweb 500b Pro Firmware
Copeland xweb 500b Pro
Copeland xweb 500d Pro
Copeland xweb 500d Pro Firmware
Copeland xweb 300d Pro
Copeland xweb 300d Pro Firmware

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de inyección de comandos del sistema operativo (OS) existe en XWEB Pro versión 1.12.1 y anteriores, lo que permite a un atacante autenticado lograr la ejecución remota de código en el sistema al configurar un estado LCD maliciosamente diseñado que es procesado posteriormente durante la configuración del sistema, lo que permite la ejecución remota de código.

27 Feb 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 02:16

Updated : 2026-02-27 23:07

NVD link : CVE-2026-25037

Mitre link : CVE-2026-25037

CVE.ORG link : CVE-2026-25037

JSON object : View

Products Affected

copeland

  • xweb_300d_pro
  • xweb_500d_pro_firmware
  • xweb_300d_pro_firmware
  • xweb_500d_pro
  • xweb_500b_pro
  • xweb_500b_pro_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')