Vulnerability Details CVE-2026-24452
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted template file to the devices route.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 28.9%
CVSS Severity
CVSS v3 Score 8.0
References
Products affected by CVE-2026-24452
-
cpe:2.3:h:copeland:xweb_300d_pro:-
-
cpe:2.3:h:copeland:xweb_500b_pro:-
-
cpe:2.3:h:copeland:xweb_500d_pro:-
-
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*
-
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*
-
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*