CVE-2026-25037
EUVD-2026-897627.02.2026, 02:16
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| copeland | xweb_300d_pro_firmware | 𝑥 ≤ 1.12.1 |
| copeland | xweb_500d_pro_firmware | 𝑥 ≤ 1.12.1 |
| copeland | xweb_500b_pro_firmware | 𝑥 ≤ 1.12.1 |
𝑥
= Vulnerable software versions