Threat reportIoTTL-2026-3578
CVE-2026-20797: Copeland XWEB Pro Unauthenticated Stack-Based Buffer Overflow in API Route
CVE-2026-20797 (TL-2026-3578), also tracked as ICSA-26-057-10, is a medium-severity IoT security threat scored CVSS 4.3, first published 2026-10-15. It has no confirmed attribution, affects Copeland XWEB 300D PRO, references 1 CVE (CVE-2026-20797), maps to 4 MITRE ATT&CK techniques (T0814, T1190, T1499.004), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 4.3/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3578
- Threat ID
- TL-2026-3578
- Also known as
- ICSA-26-057-10
- Severity
- MEDIUM
- CVSS
- 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- Status
- PATCHED
- Category
- IOT
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial facilities, retail, food service, building automation
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 9
How CVE-2026-20797 works
A stack-based buffer overflow in an API route of Copeland XWEB Pro 1.12.1 and prior lets unauthenticated attackers cause stack corruption and terminate the program. Affects XWEB 300D PRO, 500D PRO and 500B PRO; Copeland has released a fix.
CVE-2026-20797 is a stack-based buffer overflow (CWE-121, with CWE-787 out-of-bounds write as the secondary weakness) in an API route of Copeland XWEB Pro version 1.12.1 and prior. Copeland XWEB Pro is a web-based supervision and monitoring platform for commercial refrigeration and HVAC equipment. Per the CVE record, an unauthenticated attacker can send input to the vulnerable API route to cause stack corruption and termination of the program, resulting in loss of availability of the XWEB Pro service.
Severity scoring is inconsistent between scorers. The CNA (CISA ICS) scored the flaw CVSS 3.1 4.3 MEDIUM (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), reflecting an adjacent-network attack vector and availability-only impact. NVD's own secondary assessment is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes network reachability and full CIA impact. The sources only state stack corruption and program termination; arbitrary code execution is not described for this specific CVE, although the parent CISA advisory notes the overall set of XWEB vulnerabilities enables authentication bypass, denial-of-service, memory corruption and arbitrary code execution.
The flaw is one of 23 CVEs published together in CISA advisory ICSA-26-057-10 (released 2026-02-26) covering Copeland XWEB and XWEB Pro, including OS command injection, path traversal, broken cryptography and unexpected-status-code weaknesses. It was reported to CISA by Amir Zaltzman and Noam Moshe of Claroty Team82. The CVE record was reserved 2026-02-05 and published 2026-02-27. CISA states no known public exploitation specifically targeting these vulnerabilities has been reported; no public PoC and no CISA KEV listing were identified in the sources (EPSS 0.00815 as of 2026-10-14). The sources do not name the vulnerable API route or the fixed build number.
Copeland has released a fix. Users should update XWEB Pro to the latest version through the Copeland software update page or, for devices with internet access, via SYSTEM > Updates | Network on the device. Because the product sits in the Commercial Facilities sector and is deployed worldwide, devices should not be exposed to the internet and should be restricted to trusted management networks.
MITRE ATT&CK techniques used in TL-2026-3578
inhibit-response-function
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1499.004 Application or System Exploitation
Reconnaissance
Affected products and versions in CVE-2026-20797
- Copeland — XWEB 300D PRO
Vulnerable versions: 1.12.1 and prior
Fixed in: Latest XWEB Pro release (build not specified) - Copeland — XWEB 500D PRO
Vulnerable versions: 1.12.1 and prior
Fixed in: Latest XWEB Pro release (build not specified) - Copeland — XWEB 500B PRO
Vulnerable versions: 1.12.1 and prior
Fixed in: Latest XWEB Pro release (build not specified)
Remediation for CVE-2026-20797
Patches
- Copeland XWEB Pro update newer than 1.12.1 (exact fixed build not stated in sources)
Immediate actions
- Update XWEB Pro to the latest Copeland release via https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- On devices with internet access, update directly via SYSTEM > Updates | Network
- Ensure XWEB 300D PRO, 500D PRO and 500B PRO management interfaces are not reachable from the internet
Workarounds
- Restrict network access to the XWEB Pro web/API interface to trusted management hosts only
Longer-term hardening
- Segment building-automation and refrigeration monitoring devices from enterprise networks
- Monitor for unexpected XWEB Pro service crashes or restarts as a possible exploitation indicator
- Track the other 23 CVEs in ICSA-26-057-10 and apply all fixes in the same update
CVEs associated with CVE-2026-20797
Weaknesses (CWE) in CVE-2026-20797
Timeline of CVE-2026-20797
- CVE-2026-20797 reserved in the CVE program.
- CISA releases ICSA-26-057-10 covering 23 Copeland XWEB / XWEB Pro CVEs, including CVE-2026-20797, credited to Amir Zaltzman of Claroty Team82.
- Copeland fix available; users directed to the Copeland software update page or SYSTEM > Updates | Network on the device.
- CVE-2026-20797 published; CNA score CVSS 3.1 4.3 MEDIUM (AV:A), NVD secondary assessment 9.8 CRITICAL.
- CVE record last updated per CIRCL Vulnerability-Lookup.
- EPSS score 0.00815 (56th percentile); no known public exploitation reported by CISA and no KEV listing identified.
Sources cited for CVE-2026-20797
Detection coverage for TL-2026-3578
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3578 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.