CVE-2026-24663

CRITICAL

9.0

Descricao

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

Detalhes CVE

Pontuacao CVSS v3.19.0

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado2/27/2026

Ultima modificacao3/9/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

copeland:xweb_300d_procopeland:xweb_300d_pro_firmwarecopeland:xweb_500b_procopeland:xweb_500b_pro_firmwarecopeland:xweb_500d_procopeland:xweb_500d_pro_firmware

Fraquezas (CWE)

CWE-78

Referencias

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json(ics-cert@hq.dhs.gov)

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate(ics-cert@hq.dhs.gov)

https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10(ics-cert@hq.dhs.gov)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.