CVE Feed

    Dashboard / CVE / CVE-2026-25721

    CVE-2026-25721

    An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore action in the API V1 route.

    Published:Feb 27, 2026
    Last Modified:Apr 16, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.00133
    CVSS Score:8

    Affected Products

    Vendor
    Copeland
    Product
    Copeland Xweb 300d Pro
    Vendor
    Copeland
    Product
    Copeland Xweb 500b Pro
    Vendor
    Copeland
    Product
    Copeland Xweb 500d Pro
    Vendor
    Copeland
    Product
    Xweb 300d Pro
    Vendor
    Copeland
    Product
    Xweb 300d Pro Firmware
    Vendor
    Copeland
    Product
    Xweb 500b Pro
    Vendor
    Copeland
    Product
    Xweb 500b Pro Firmware
    Vendor
    Copeland
    Product
    Xweb 500d Pro
    Vendor
    Copeland
    Product
    Xweb 500d Pro Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-3037 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated …
    CVE-2026-20797 (CVSS 4.3) — A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthent…
    CVE-2026-22877 (CVSS 3.7) — An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated at…
    CVE-2026-25037 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticate…
    CVE-2026-25196 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-20764 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-23702 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-24452 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticate…
    CVE-2026-25105 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenti…
    CVE-2026-24695 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authentic…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High