Threat reportVulnerabilityTL-2026-3582
CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (XWEB 300D/500D/500B PRO) Enabling Authenticated RCE
CVE-2026-25037 (TL-2026-3582), also tracked as ICSA-26-057-10, is a high-severity software vulnerability scored CVSS 8, first published 2026-10-15. It has no confirmed attribution, affects Copeland XWEB 300D PRO, references 1 CVE (CVE-2026-25037), maps to 3 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3582
- Threat ID
- TL-2026-3582
- Also known as
- ICSA-26-057-10, INCIBE-2026-153, EUVD-2026-8976
- Severity
- HIGH
- CVSS
- 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial facilities, food retail, cold chain, refrigeration
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-25037 works
An OS command injection flaw (CWE-78) in Copeland XWEB Pro firmware 1.12.1 and prior lets an authenticated attacker achieve remote code execution by configuring a maliciously crafted LCD state that is later processed during system setup. It is one of 23 vulnerabilities in CISA advisory ICSA-26-057-10 reported by Claroty Team82; CISA reports no known public exploitation.
CVE-2026-25037 affects the Copeland XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO supervisory controllers running firmware 1.12.1 and prior. An authenticated attacker can configure a maliciously crafted LCD state; the value is later processed during system setup and is not neutralized before reaching an OS command, resulting in remote code execution (CWE-78). The CVE record was reserved 2026-02-05 and published 2026-02-27 (updated 2026-03-02). The CNA (CISA ICS) scores it CVSS 3.1 8.0 HIGH (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H); NIST's primary NVD score is 8.8 HIGH (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the privilege required and attack complexity differ by scorer.
The flaw is one of 23 vulnerabilities published together in CISA advisory ICSA-26-057-10 (released 2026-02-26, Commercial Facilities sector, deployed worldwide, vendor HQ United States). The set was discovered by Amir Zaltzman and Noam Moshe of Claroty Team82. INCIBE-CERT (INCIBE-2026-153) summarizes the set as 2 critical, 19 high, 1 medium and 1 low severity. The advisory's other entries include CVE-2026-21718 (CWE-327, CVSS 10.0, authentication bypass enabling pre-authenticated code execution), CVE-2026-25085 (CWE-394, CVSS 8.6, authentication bypass via unexpected authentication-routine return value), CVE-2026-24663 (CWE-78, CVSS 9.0, unauthenticated RCE via crafted library installation request), and a large cluster of authenticated CWE-78 injections (contacts import, restore operations, templates route, firmware update route/file upload/devices field, among others). Secondary reporting on the Team82 research (not independently verified here) states these flaws can be chained so that an unauthenticated attacker obtains root-level code execution, which makes the authenticated-only prerequisite of CVE-2026-25037 weaker in practice on unpatched devices.
Exploitation status: CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it, and the SSVC entries in the CSAF record show no exploitation for the command-injection items. No public PoC is referenced in any source reviewed, and none is asserted here. Specific details of the LCD-state parameter, the vulnerable endpoint and the shell context are not published in the sources reviewed. Secondary reporting says the research was presented at DEF CON 34 and that the issues were corrected in XWEB Pro 1.13; the vendor and CISA pages only instruct users to update to the latest version. Remediation: update via Copeland's software update page, or on internet-connected units via the SYSTEM -> Updates | Network menu. CISA additionally recommends minimizing network exposure, keeping control system devices off the internet, placing them behind firewalls isolated from business networks, and using VPNs for remote access.
MITRE ATT&CK techniques used in TL-2026-3582
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Affected products and versions in CVE-2026-25037
- Copeland — XWEB 300D PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest version per Copeland software update page - Copeland — XWEB 500D PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest version per Copeland software update page - Copeland — XWEB 500B PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest version per Copeland software update page
Remediation for CVE-2026-25037
Patches
- Latest XWEB Pro firmware from Copeland (versions after 1.12.1)
Immediate actions
- Update XWEB 300D/500D/500B PRO to the latest firmware (fixed in a release after 1.12.1; secondary reporting cites 1.13) via https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- On internet-connected units, update from the device menu SYSTEM -> Updates | Network
- Review and rotate XWEB Pro accounts; restrict who can change LCD/system-setup configuration
Workarounds
- No vendor workaround published; restrict management-interface access to trusted admin networks until patched
Longer-term hardening
- Minimize network exposure of control system devices and ensure they are not reachable from the internet
- Place XWEB devices behind firewalls, isolated from business networks
- Use VPNs for remote access, keeping them updated, and perform impact analysis before deploying defensive measures
CVEs associated with CVE-2026-25037
Weaknesses (CWE) in CVE-2026-25037
Timeline of CVE-2026-25037
- CVE-2026-25037 identifier reserved in the CVE Program.
- CISA SSVC assessment recorded for the ICSA-26-057-10 vulnerabilities (no exploitation for the command-injection entries).
- CISA releases ICS advisory ICSA-26-057-10 covering 23 Copeland XWEB / XWEB Pro vulnerabilities reported by Claroty Team82.
- CVE-2026-25037 published (CNA CVSS 8.0 HIGH, CWE-78); NVD primary score 8.8 HIGH; INCIBE-CERT alert INCIBE-2026-153 issued.
- CVE record for CVE-2026-25037 updated.
- Secondary reporting states Claroty Team82's Amir Zaltzman presented the 23-vulnerability Copeland XWEB Pro research (chainable to unauthenticated root RCE) at DEF CON 34 (held 6-9 August 2026; exact session date not stated in sources).
Sources cited for CVE-2026-25037
- Claroty Team82 Disclosure Dashboard - CVE-2026-25037
- CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro
- CISA CSAF record icsa-26-057-10.json
- Copeland XWEB Pro System Software Update
- NVD - CVE-2026-25037
- CVE Program record CVE-2026-25037
- INCIBE-CERT: Multiple vulnerabilities in Copeland XWEB and XWEB Pro
- SOCRadar CVE Radar - CVE-2026-25037
- EUVD-2026-8976 (via Vulners)
- Critical Vulnerabilities Found in Copeland XWEB Pro Refrigeration Controllers (ThreatCluster)
- Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers (OffSeq)
- NVD detail page CVE-2026-25037
Detection coverage for TL-2026-3582
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3582 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.