VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 27, 2026· Updated Mar 3, 2026

Copeland XWEB and XWEB Pro OS Command Injection

CVE-2026-24689

Description

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update apply action.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Xweb/Xwebllm-fuzzy
    Range: <=1.12.1
  • Copeland/Copeland XWEB 300D PROv5
    Range: 0
  • Copeland/Copeland XWEB 500B PROv5
    Range: 0
  • Copeland/Copeland XWEB 500D PROv5
    Range: 0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.