Vulnerability Details CVE-2026-24517
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into requests sent to the firmware update
route.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.1%
CVSS Severity
CVSS v3 Score 8.0
References
Products affected by CVE-2026-24517
-
cpe:2.3:h:copeland:xweb_300d_pro:-
-
cpe:2.3:h:copeland:xweb_500b_pro:-
-
cpe:2.3:h:copeland:xweb_500d_pro:-
-
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*
-
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*
-
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*