# CVE-2026-20797: Copeland XWEB Pro Unauthenticated Stack-Based Buffer Overflow in API Route

> A stack-based buffer overflow in an API route of Copeland XWEB Pro 1.12.1 and prior lets unauthenticated attackers cause stack corruption and terminate the program. Affects XWEB 300D PRO, 500D PRO and 500B PRO; Copeland has released a fix.

- **Published:** 2026-10-15T02:49:47Z
- **Last reviewed:** 2026-10-15T02:49:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3578
- **ID:** TL-2026-3578
- **Severity:** MEDIUM (CVSS 4.3)
- **Category:** IOT
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20797

## Description

CVE-2026-20797 is a stack-based buffer overflow (CWE-121, with CWE-787 out-of-bounds write as the secondary weakness) in an API route of Copeland XWEB Pro version 1.12.1 and prior. Copeland XWEB Pro is a web-based supervision and monitoring platform for commercial refrigeration and HVAC equipment. Per the CVE record, an unauthenticated attacker can send input to the vulnerable API route to cause stack corruption and termination of the program, resulting in loss of availability of the XWEB Pro service.

Severity scoring is inconsistent between scorers. The CNA (CISA ICS) scored the flaw CVSS 3.1 4.3 MEDIUM (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), reflecting an adjacent-network attack vector and availability-only impact. NVD's own secondary assessment is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes network reachability and full CIA impact. The sources only state stack corruption and program termination; arbitrary code execution is not described for this specific CVE, although the parent CISA advisory notes the overall set of XWEB vulnerabilities enables authentication bypass, denial-of-service, memory corruption and arbitrary code execution.

The flaw is one of 23 CVEs published together in CISA advisory ICSA-26-057-10 (released 2026-02-26) covering Copeland XWEB and XWEB Pro, including OS command injection, path traversal, broken cryptography and unexpected-status-code weaknesses. It was reported to CISA by Amir Zaltzman and Noam Moshe of Claroty Team82. The CVE record was reserved 2026-02-05 and published 2026-02-27. CISA states no known public exploitation specifically targeting these vulnerabilities has been reported; no public PoC and no CISA KEV listing were identified in the sources (EPSS 0.00815 as of 2026-10-14). The sources do not name the vulnerable API route or the fixed build number.

Copeland has released a fix. Users should update XWEB Pro to the latest version through the Copeland software update page or, for devices with internet access, via SYSTEM > Updates | Network on the device. Because the product sits in the Commercial Facilities sector and is deployed worldwide, devices should not be exposed to the internet and should be restricted to trusted management networks.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1499.004 Application or System Exploitation
- T0814 Denial of Service

## Sources

- [Claroty Team82 Disclosure Dashboard: CVE-2026-20797](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-20797)
- [CISA ICS Advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [NVD: CVE-2026-20797](https://nvd.nist.gov/vuln/detail/CVE-2026-20797)
- [CISA CSAF: icsa-26-057-10.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [Copeland XWEB System Software Updates](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [CIRCL Vulnerability-Lookup: CVE-2026-20797](https://cvepremium.circl.lu/vuln/cve-2026-20797)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3578