Cyber Posture

CVE-2026-23702

High

Published: 27 February 2026

Published
27 February 2026
Modified
27 February 2026
KEV Added
Patch
CVSS Score 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0004 11.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2026-23702 is an OS command injection vulnerability (CWE-78) in XWEB Pro version 1.12.1 and prior. The issue allows malicious input to be injected into the server username field during the import preconfiguration action in the API V1 route, published on 2026-02-27 with a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

An authenticated attacker with high privileges can exploit this vulnerability remotely by sending crafted input to the affected API endpoint, resulting in remote code execution on the underlying system.

CISA advisory ICSA-26-057-10, along with the associated CSAF document and Copeland's system software update page, provide guidance on mitigations, including available software updates to address the vulnerability.

Details

CWE(s)
CWE-78

Affected Products

copeland
xweb 300d pro firmware
≤ 1.12.1
copeland
xweb 500d pro firmware
≤ 1.12.1
copeland
xweb 500b pro firmware
≤ 1.12.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

OS command injection vulnerability in a network-accessible API endpoint enabling remote code execution directly maps to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References