CVE-2026-3037
published 2026-02-27CVE-2026-3037: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.93%
77.5th percentile
An OS command injection vulnerability exists in XWEB Pro version 1.12.1
and prior, enabling an authenticated attacker to achieve remote code
execution on the system by modifying malicious input injected into the
MBird SMS service URL and/or code via the utility route which is later
processed during system setup, leading to remote code execution.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| copeland | copeland_xweb_300d_pro | <= 1.12.1 | — |
| copeland | copeland_xweb_500b_pro | <= 1.12.1 | — |
| copeland | copeland_xweb_500d_pro | <= 1.12.1 | — |
| copeland | xweb_300d_pro_firmware | <= 1.12.1 | — |
| copeland | xweb_500b_pro_firmware | <= 1.12.1 | — |
| copeland | xweb_500d_pro_firmware | <= 1.12.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Copeland XWEB and XWEB Pro
cisa_ics·2026-02-26·CVSS 8.0
[HIGH] Copeland XWEB and XWEB Pro
ICS Advisory
##
Copeland XWEB and XWEB Pro
Release DateFebruary 26, 2026
Alert CodeICSA-26-057-10
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code.
The following versions of Copeland XWEB and XWEB Pro are affected:
- XWEB 300D PRO <=1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663, CVE-2026-21389, CVE-2026-25111, CVE-2026-20742, CVE-2026-24517, CVE-2026-25195, CVE-2026-20910, CVE-2026-24689, CVE-2026-25109, CVE-2026-20902, CVE-2026-24695, CVE-2026-25105, CVE-2026-24452, CVE-2026-23702, CVE-2026-25721, CVE-2026
GHSA
GHSA-f2v6-m58p-hr23: An OS command injection vulnerability exists in XWEB Pro version 1
ghsa_unreviewed·2026-02-27
CVE-2026-3037 [HIGH] CWE-78 GHSA-f2v6-m58p-hr23: An OS command injection vulnerability exists in XWEB Pro version 1
An OS command injection vulnerability exists in XWEB Pro version 1.12.1
and prior, enabling an authenticated attacker to achieve remote code
execution on the system by modifying malicious input injected into the
MBird SMS service URL and/or code via the utility route which is later
processed during system setup, leading to remote code execution.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-02-27
Published