Read the docs
TI-2026-02621 Aliases CVE-2026-3037GHSA-f2v6-m58p-hr23

Copeland XWEB and XWEB Pro OS Command Injection

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed during system setup, leading to remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02135 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CopelandCopeland XWEB 300D PROup to 1.12.1—No fix listedCNA
CopelandCopeland XWEB 500D PROup to 1.12.1—No fix listedCNA
CopelandCopeland XWEB 500B PROup to 1.12.1—No fix listedCNA
  • Copeland XWEB 300D PRO VendorCopeland Affected up to 1.12.1 Fixed in — No fix listed CNA
  • Copeland XWEB 500D PRO VendorCopeland Affected up to 1.12.1 Fixed in — No fix listed CNA
  • Copeland XWEB 500B PRO VendorCopeland Affected up to 1.12.1 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*up to 1.12.1VulnerableCopeland
cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onCopeland
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*up to 1.12.1VulnerableCopeland
cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onCopeland
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*up to 1.12.1VulnerableCopeland
cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onCopeland
  • cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:* Versions up to 1.12.1 Vulnerable ·Copeland
  • cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Copeland
  • cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:* Versions up to 1.12.1 Vulnerable ·Copeland
  • cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Copeland
  • cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:* Versions up to 1.12.1 Vulnerable ·Copeland
  • cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Copeland

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3037
  2. 2026-10-03 Alias added: GHSA-f2v6-m58p-hr23

References

Advisory 2

Other 1

  • TI-2026-17491 Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm CVSS 3.1CRITICAL 10.0
  • TI-2026-20260 Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value CVSS 3.1CRITICAL 9.8
  • TI-2026-19885 Copeland XWEB and XWEB Pro OS Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-20790 Copeland XWEB and XWEB Pro OS Command Injection CVSS 3.1HIGH 8.8
  • TI-2026-20352 Copeland XWEB and XWEB Pro OS Command Injection CVSS 3.1HIGH 8.8
  • TI-2026-20274 Copeland XWEB and XWEB Pro OS Command Injection CVSS 3.1HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences