CVE Feed

    Dashboard / CVE / CVE-2026-25085

    CVE-2026-25085

    A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.

    Published:Feb 27, 2026
    Last Modified:Apr 16, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.00109
    CVSS Score:8.6

    Affected Products

    Vendor
    Copeland
    Product
    Copeland Xweb 300d Pro
    Vendor
    Copeland
    Product
    Copeland Xweb 500b Pro
    Vendor
    Copeland
    Product
    Copeland Xweb 500d Pro
    Vendor
    Copeland
    Product
    Xweb 300d Pro
    Vendor
    Copeland
    Product
    Xweb 300d Pro Firmware
    Vendor
    Copeland
    Product
    Xweb 500b Pro
    Vendor
    Copeland
    Product
    Xweb 500b Pro Firmware
    Vendor
    Copeland
    Product
    Xweb 500d Pro
    Vendor
    Copeland
    Product
    Xweb 500d Pro Firmware

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-3037 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated …
    CVE-2026-20797 (CVSS 4.3) — A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthent…
    CVE-2026-22877 (CVSS 3.7) — An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated at…
    CVE-2026-25037 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticate…
    CVE-2026-25196 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-20764 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-25721 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-23702 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-24452 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticate…
    CVE-2026-25105 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenti…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High