CVE-2026-24663

The attacker sends a crafted network request to the endpoint responsible for library installation in the XWEB Pro system. In the request body, they inject malicious operating system commands, which are then executed by the vulnerable component without proper validation and sanitization of input data. The attack is possible remotely over the network without the need to possess an account in the system.

Successful exploitation of the vulnerability gives the attacker full control over the device through remote code execution (RCE) with operating system privilege level, which may lead to violations of confidentiality, integrity, and system availability.

Patches available from the manufacturer should be applied in accordance with the references — update available at https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate. It is also recommended to limit network access to XWEB Pro devices through a firewall and to isolate the OT network from corporate networks and the Internet.

Copeland XWEB Pro in version 1.12.1 and earlier — affects Copeland Xweb 500B Pro, Copeland Xweb 300D Pro, and Copeland Xweb 500D Pro devices (firmware and software).