An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 27, 2026 · NIST NVD

   Detected

   An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

2. Jun 17, 2026 · NIST NVD

   Updated

   An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

Affected

• cpe copeland/xweb 300d pro firmwareversion unspecified
• cpe copeland/xweb 500b pro firmwareversion unspecified
• cpe copeland/xweb 500d pro firmwareversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2026-24663

  An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the reques

  nvd.nist.gov

References

• Third Party Advisory · github.com
• Product · webapps.copeland.com
• Third Party Advisory · cisa.gov