Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2026-24663

Copeland XWEB and XWEB Pro OS Command Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Copeland Copeland XWEB 300D PRO

Default version status: unaffected

  • 0 to ≤ 1.12.1affected

Copeland Copeland XWEB 500D PRO

Default version status: unaffected

  • 0 to ≤ 1.12.1affected

Copeland Copeland XWEB 500B PRO

Default version status: unaffected

  • 0 to ≤ 1.12.1affected

References