An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.
Copeland XWEB 300D PRO: <=1.12.1, Copeland XWEB 500D PRO: <=1.12.1, Copeland XWEB 500B PRO: <=1.12.1 are affected.
Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page. Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.
CVE-2026-24663
Copeland
XWEB, XWEB Pro
9.0
Team82 is committed to privately reporting vulnerabilities to affected vendors in a coordinated, timely manner in order to ensure the safety of the cybersecurity ecosystem worldwide. To engage with the vendor and research community, Team82 invites you to download and share our Coordinated Disclosure Policy. Team82 will adhere to this reporting and disclosure process when we discover vulnerabilities in products and services.
Team82 has also made its public PGP Key available for the vendor and research community to securely and safely exchange vulnerability and research information with us.
