Cyber Posture

CVE-2026-25037

High

Published: 27 February 2026

Published
27 February 2026
Modified
27 February 2026
KEV Added
—
Patch
—
CVSS Score 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0004 11.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2026-25037 is an OS command injection vulnerability (CWE-78) affecting XWEB Pro version 1.12.1 and prior versions. The flaw allows an authenticated attacker to achieve remote code execution (RCE) on the affected system by configuring a maliciously crafted LCD state, which is subsequently processed during system setup. The vulnerability carries a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.

Exploitation requires network access and high privileges (PR:H), with high attack complexity (AC:H) but no user interaction (UI:N). A successful attack enables the adversary to execute arbitrary operating system commands remotely, potentially leading to full control over the system, including high impacts on confidentiality, integrity, and availability in a scoped environment.

CISA's ICS Advisory (ICSA-26-057-10) details the vulnerability, with corresponding machine-readable data available via the Cybersecurity and Infrastructure Security Agency's GitHub CSAF repository. Mitigation guidance and patches are referenced in the Dixell/Copeland system software update page, recommending users apply the latest updates to address the issue.

Details

CWE(s)
CWE-78

Affected Products

copeland
xweb 300d pro firmware
≤ 1.12.1
copeland
xweb 500d pro firmware
≤ 1.12.1
copeland
xweb 500b pro firmware
≤ 1.12.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection vulnerability in network-accessible web interface (XWEB Pro) enables exploitation of public-facing or remote services (T1190, T1210) for RCE via Unix shell commands (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References