CVE-2026-20764

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Copeland	Copeland XWEB 300D PRO	<= 1.12.1
Copeland	Copeland XWEB 500D PRO	<= 1.12.1
Copeland	Copeland XWEB 500B PRO	<= 1.12.1

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.jsonThird Party Advisory
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdateProduct
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10Third Party Advisory, US Government Resource

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-207654.2Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of p CVE-2026-207668.8An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.CVE-2026-207677.8Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow CVE-2026-207696.1Improper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unpri CVE-2026-20778.8A security vulnerability has been detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the CVE-2026-207706.7Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applicati CVE-2026-207716.1Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a CVE-2026-207726.7Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121.193 within Ring 3: U CVE-2026-207738.5A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with cert CVE-2026-207755.3Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a CVE-2026-207768.6Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Netwo CVE-2026-207778.1A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master