# CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (XWEB 300D/500D/500B PRO) Enabling Authenticated RCE

> An OS command injection flaw (CWE-78) in Copeland XWEB Pro firmware 1.12.1 and prior lets an authenticated attacker achieve remote code execution by configuring a maliciously crafted LCD state that is later processed during system setup. It is one of 23 vulnerabilities in CISA advisory ICSA-26-057-10 reported by Claroty Team82; CISA reports no known public exploitation.

- **Published:** 2026-10-15T03:37:15Z
- **Last reviewed:** 2026-10-15T03:37:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3582
- **ID:** TL-2026-3582
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25037

## Description

CVE-2026-25037 affects the Copeland XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO supervisory controllers running firmware 1.12.1 and prior. An authenticated attacker can configure a maliciously crafted LCD state; the value is later processed during system setup and is not neutralized before reaching an OS command, resulting in remote code execution (CWE-78). The CVE record was reserved 2026-02-05 and published 2026-02-27 (updated 2026-03-02). The CNA (CISA ICS) scores it CVSS 3.1 8.0 HIGH (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H); NIST's primary NVD score is 8.8 HIGH (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the privilege required and attack complexity differ by scorer.

The flaw is one of 23 vulnerabilities published together in CISA advisory ICSA-26-057-10 (released 2026-02-26, Commercial Facilities sector, deployed worldwide, vendor HQ United States). The set was discovered by Amir Zaltzman and Noam Moshe of Claroty Team82. INCIBE-CERT (INCIBE-2026-153) summarizes the set as 2 critical, 19 high, 1 medium and 1 low severity. The advisory's other entries include CVE-2026-21718 (CWE-327, CVSS 10.0, authentication bypass enabling pre-authenticated code execution), CVE-2026-25085 (CWE-394, CVSS 8.6, authentication bypass via unexpected authentication-routine return value), CVE-2026-24663 (CWE-78, CVSS 9.0, unauthenticated RCE via crafted library installation request), and a large cluster of authenticated CWE-78 injections (contacts import, restore operations, templates route, firmware update route/file upload/devices field, among others). Secondary reporting on the Team82 research (not independently verified here) states these flaws can be chained so that an unauthenticated attacker obtains root-level code execution, which makes the authenticated-only prerequisite of CVE-2026-25037 weaker in practice on unpatched devices.

Exploitation status: CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it, and the SSVC entries in the CSAF record show no exploitation for the command-injection items. No public PoC is referenced in any source reviewed, and none is asserted here. Specific details of the LCD-state parameter, the vulnerable endpoint and the shell context are not published in the sources reviewed. Secondary reporting says the research was presented at DEF CON 34 and that the issues were corrected in XWEB Pro 1.13; the vendor and CISA pages only instruct users to update to the latest version. Remediation: update via Copeland's software update page, or on internet-connected units via the SYSTEM -> Updates | Network menu. CISA additionally recommends minimizing network exposure, keeping control system devices off the internet, placing them behind firewalls isolated from business networks, and using VPNs for remote access.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-25037](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-25037)
- [CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [CISA CSAF record icsa-26-057-10.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [Copeland XWEB Pro System Software Update](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [NVD - CVE-2026-25037](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-25037)
- [CVE Program record CVE-2026-25037](https://cveawg.mitre.org/api/cve/CVE-2026-25037)
- [INCIBE-CERT: Multiple vulnerabilities in Copeland XWEB and XWEB Pro](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-copeland-xweb-y-xweb-pro)
- [SOCRadar CVE Radar - CVE-2026-25037](https://socradar.io/free-tools/cve-radar/CVE-2026-25037)
- [EUVD-2026-8976 (via Vulners)](https://vulners.com/euvd/EUVD-2026-8976)
- [Critical Vulnerabilities Found in Copeland XWEB Pro Refrigeration Controllers (ThreatCluster)](https://threatcluster.io/cluster/copeland-xweb-pro-vulnerabilities-let-attackers-gain-root-ac-886e8734)
- [Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers (OffSeq)](https://radar.offseq.com/threat/chilling-discoveries-unpacking-vulnerabilities-in-copeland-xweb-pro-controllers-17650453e698ab87)
- [NVD detail page CVE-2026-25037](https://nvd.nist.gov/vuln/detail/cve-2026-25037)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3582