Description
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
configuring a maliciously crafted LCD state which is later processed
during system setup, enabling remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Copeland | Copeland XWEB 300D PRO | ≤ 1.12.1 | — |
| Copeland | Copeland XWEB 500D PRO | ≤ 1.12.1 | — |
| Copeland | Copeland XWEB 500B PRO | ≤ 1.12.1 | — |
Advisories 1
- ICSA-26-057-10 Copeland XWEB and XWEB Pro CISA ICS & IT advisories · Feb 26, 2026