Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-24452

Copeland XWEB and XWEB Pro OS Command Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Copeland Copeland XWEB 300D PRO

Default version status: unaffected

  • 0 to ≤ 1.12.1affected

Copeland Copeland XWEB 500D PRO

Default version status: unaffected

  • 0 to ≤ 1.12.1affected

Copeland Copeland XWEB 500B PRO

Default version status: unaffected

  • 0 to ≤ 1.12.1affected

References