CVE-2026-24695

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into OpenSSL argument fields within requests sent to the utility route, leading to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Copeland	Copeland XWEB 300D PRO	<= 1.12.1
Copeland	Copeland XWEB 500D PRO	<= 1.12.1
Copeland	Copeland XWEB 500B PRO	<= 1.12.1

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.jsonThird Party Advisory
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdateProduct
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10Third Party Advisory, US Government Resource

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-246967.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting m CVE-2026-246977.2An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 CVE-2026-246987.2An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware CVE-2026-246997.2An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and CVE-2026-24704.3The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up CVE-2026-247007.2An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 an CVE-2026-247088.2An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a roo CVE-2026-24717.5The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserializat CVE-2026-247106.1Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.CVE-2026-247115.3Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.CVE-2026-247127.3Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.CVE-2026-247139.8Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.