Unrated severityNVD Advisory· Published Feb 27, 2026· Updated Mar 2, 2026

Copeland XWEB and XWEB Pro OS Command Injection

CVE-2026-24517

Description

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Xweb/Xwebllm-fuzzy
Range: <=1.12.1
Copeland/Copeland XWEB 300D PROv5
Range: 0
Copeland/Copeland XWEB 500B PROv5
Range: 0
Copeland/Copeland XWEB 500D PROv5
Range: 0

Patches

Vulnerability mechanics

References

github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.jsonmitre
webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdatemitre
www.cisa.gov/news-events/ics-advisories/icsa-26-057-10mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000