What is CVE-2026-24663?
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.
The record classifies CVE-2026-24663 under weakness class CWE-78. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 3 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 258 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 9 — CRITICAL
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS (FIRST)
- 3.6% probability of exploitation in the next 30 days, higher than 89.7% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 8.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-02-27
Is CVE-2026-24663 being exploited?
It currently carries a trending score of 32 in the Threadlinqs vulnerability feed.
Affected products and versions
- Copeland: XWEB 300D PRO, XWEB 500D PRO, XWEB 500B PRO
How to fix CVE-2026-24663
No vendor patch reference has been recorded for CVE-2026-24663 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-24663
3 tracked threats in the Threadlinqs corpus reference CVE-2026-24663, either in the campaign’s CVE list or as an indicator on the campaign record.
- Copeland XWEB PRO refrigeration controllers abused for spam botnet, proxy/tunnel traffic and default-credential setpoint tampering (CVE-2026-25085 suspected entry point) — HIGH · 2026-11-09
- Malicious Cyber Activity Targeting Industrial Refrigeration and Cold Chain Monitoring Systems (Danfoss StoreView, Copeland/Dixell XWEB, Coolworld) — CRITICAL · 2026-11-06
- Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450) — HIGH · 2026-10-15
Sources
Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories. This product uses the NVD API but is not endorsed or certified by the NVD.