CVE-2026-3037

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3037
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed during system setup, leading to remote code execution.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json Third Party Advisory
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
History

28 Feb 2026, 01:13

Type Values Removed Values Added
References () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json - Third Party Advisory
References () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - () https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 - Third Party Advisory, US Government Resource
First Time Copeland
Copeland xweb 500b Pro Firmware
Copeland xweb 500b Pro
Copeland xweb 500d Pro
Copeland xweb 500d Pro Firmware
Copeland xweb 300d Pro
Copeland xweb 300d Pro Firmware
CPE cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de inyección de comandos del sistema operativo (OS) existe en XWEB Pro versión 1.12.1 y anteriores, lo que permite a un atacante autenticado lograr la ejecución remota de código en el sistema al modificar una entrada maliciosa inyectada en la URL del servicio SMS de MBird y/o en el código a través de la ruta de utilidad, que luego se procesa durante la configuración del sistema, lo que lleva a la ejecución remota de código.

27 Feb 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 02:16

Updated : 2026-02-28 01:13

NVD link : CVE-2026-3037

Mitre link : CVE-2026-3037

CVE.ORG link : CVE-2026-3037

JSON object : View

Products Affected

copeland

  • xweb_300d_pro
  • xweb_500d_pro_firmware
  • xweb_300d_pro_firmware
  • xweb_500d_pro
  • xweb_500b_pro
  • xweb_500b_pro_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')