CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2026-24663

CVSS 9.0v3.1pub. 2026-02-27upd. 2026-03-09

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Copeland Xweb 300d Pro

    HW
    Copeland
    wszystkie wersje

  • Copeland Xweb 300d Pro Firmware

    OS
    Copeland
    ≤ 1.12.1

  • Copeland Xweb 500b Pro

    HW
    Copeland
    wszystkie wersje

  • Copeland Xweb 500b Pro Firmware

    OS
    Copeland
    ≤ 1.12.1

  • Copeland Xweb 500d Pro

    HW
    Copeland
    wszystkie wersje

  • Copeland Xweb 500d Pro Firmware

    OS
    Copeland
    ≤ 1.12.1
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth BypassCommand Injection
CWE
References

Related vulnerabilities

CVE-2026-21718CRITICAL10.0PL ✓ten sam produkt

Auth Bypass i RCE w Copeland XWEB Pro – firmware sterowników przemysłowych

CVE-2026-20742HIGH8.0ten sam produkt

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticate...

CVE-2026-20902HIGH8.0ten sam produkt

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authentica...

CVE-2026-20910HIGH8.0ten sam produkt

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated...

CVE-2026-20764HIGH8.0ten sam produkt

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated...