Vulnerability Details CVE-2026-25195
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted firmware update file via the firmware update route.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.1%
CVSS Severity
CVSS v3 Score 8.0
References
Products affected by CVE-2026-25195
-
cpe:2.3:h:copeland:xweb_300d_pro:-
-
cpe:2.3:h:copeland:xweb_500b_pro:-
-
cpe:2.3:h:copeland:xweb_500d_pro:-
-
cpe:2.3:o:copeland:xweb_300d_pro_firmware:*
-
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*
-
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*