Threat reportVulnerabilityTL-2026-3586
CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)
CVE-2026-25196 (TL-2026-3586), also tracked as ICSA-26-057-10, is a high-severity software vulnerability scored CVSS 8, first published 2026-10-15. It has no confirmed attribution, affects Copeland XWEB 300D PRO, references 2 CVEs (CVE-2026-25196, CVE-2026-25085), maps to 6 MITRE ATT&CK techniques (T0807, T0819, T0859), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 8/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3586
- Threat ID
- TL-2026-3586
- Also known as
- ICSA-26-057-10, INCIBE-2026-153
- Severity
- HIGH
- CVSS
- 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- critical manufacturing, food and agriculture, commercial facilities, energy
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 9
How CVE-2026-25196 works
Claroty Team82 disclosed an authenticated OS command injection (CWE-78) in Copeland XWEB 300D PRO, 500D PRO and 500B PRO (firmware <= 1.12.1) where malicious input in the Wi-Fi SSID and/or password fields yields remote code execution. CISA ICSA-26-057-10 covers 23 CVEs in these products and reports no known public exploitation.
CVE-2026-25196 is an OS command injection vulnerability (CWE-78) in the web management software of Copeland XWEB Pro controllers (XWEB 300D PRO, 500D PRO, 500B PRO), firmware version 1.12.1 and earlier. An authenticated attacker who can reach the management interface can inject shell metacharacters into the Wi-Fi SSID and/or password fields processed during Wi-Fi configuration, resulting in arbitrary command execution on the device. SentinelOne's vulnerability database attributes the root cause to insufficient input validation and sanitization in the Wi-Fi configuration processing routine.
Scoring differs by source: CISA (CNA/ICS-CERT) assigns CVSS v3.1 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), while NVD lists 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This platform records the CISA score of 8.0. SentinelOne lists EPSS at 0.14% and Known Exploited: No.
The flaw is one of 23 vulnerabilities in the same product line reported by Claroty Team82 researchers Amir Zaltzman and Noam Moshe (2 critical, 19 high, 1 medium, 1 low) and published in CISA ICSA-26-057-10 on 2026-02-26. The set includes CVE-2026-21718 (CVSS 10.0, CWE-327, pre-authenticated code execution via authentication bypass), CVE-2026-24663 (CVSS 9.0, unauthenticated RCE via the libraries installation endpoint), CVE-2026-25085 (CVSS 8.6, authentication bypass caused by an unexpected return value from the authentication routine being treated as legitimate), about 18 further authenticated command-injection flaws across routes such as contacts import, restore, templates, firmware update, parameters, utility, devices, API v1, Wi-Fi configuration, LCD state and hostname configuration, plus CVE-2026-22877 (unauthenticated path traversal / arbitrary file read) and CVE-2026-20797 (adjacent-network stack buffer overflow). The unauthenticated authentication-bypass and RCE flaws can plausibly be chained with the authenticated injection bugs; this chaining is an analytic inference, not something stated by the sources.
No public PoC or in-the-wild exploitation has been confirmed in the sources reviewed; CISA states no known public exploitation specifically targeting these vulnerabilities has been reported. Copeland XWEB Pro devices are web management front-ends for commercial refrigeration and building controllers, so compromise of the device may expose the connected OT environment. Remediation is to update to the latest XWEB Pro software via Copeland's software update page or SYSTEM > Updates | Network on internet-connected units.
MITRE ATT&CK techniques used in TL-2026-3586
Execution
T0807 Command-Line Interface; T1059 Command and Scripting Interpreter
Initial Access
T0819 Exploit Public-Facing Application; T1078 Valid Accounts; T1190 Exploit Public-Facing Application
persistence
Persistence
Privilege Escalation
Defense Evasion
Affected products and versions in CVE-2026-25196
- Copeland — XWEB 300D PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest XWEB Pro version via Copeland software update page - Copeland — XWEB 500D PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest XWEB Pro version via Copeland software update page - Copeland — XWEB 500B PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest XWEB Pro version via Copeland software update page
Remediation for CVE-2026-25196
Patches
- Latest XWEB Pro version via https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- Internet-connected devices: SYSTEM > Updates | Network menu
Immediate actions
- Update Copeland XWEB 300D PRO, 500D PRO and 500B PRO to the latest XWEB Pro software release
- Minimize network exposure; ensure XWEB Pro management interfaces are not reachable from the internet
- Place control systems behind firewalls and isolate them from business networks
- Review Wi-Fi configuration changes and device logs for SSID/password values containing shell metacharacters
Workarounds
- Restrict management interface access with firewall rules
- Use strong, unique administrator credentials, since exploitation requires authentication
Longer-term hardening
- Use VPNs for remote access to OT devices and keep VPN software current
- Segment OT networks and restrict management access to authorized hosts
- Perform impact analysis and risk assessment before deploying defensive measures
CVEs associated with CVE-2026-25196
Weaknesses (CWE) in CVE-2026-25196
Timeline of CVE-2026-25196
- CISA states no known public exploitation specifically targeting these vulnerabilities has been reported
- CISA releases ICSA-26-057-10 covering 23 CVEs in Copeland XWEB 300D PRO, 500D PRO and 500B PRO (<= 1.12.1), credited to Claroty Team82
- NVD primary score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U) recorded alongside ICS-CERT secondary score 8.0 (AV:N/AC:H/PR:H/UI:N/S:C)
- SentinelOne vulnerability database lists CVE-2026-25196 with EPSS 0.14% and no known exploitation
- INCIBE-CERT publishes advisory INCIBE-2026-153 on multiple Copeland XWEB and XWEB Pro vulnerabilities
- CVE-2026-25196 published in NVD (CWE-78; NVD score 8.8, CISA score 8.0)
- NVD record for CVE-2026-25196 last modified; vulnerability status Analyzed, CWE-78 confirmed
Sources cited for CVE-2026-25196
- Claroty Team82 Disclosure Dashboard - CVE-2026-25196
- CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro
- Copeland System Software Update (vendor fix)
- CISA CSAF file for ICSA-26-057-10
- INCIBE-CERT: Multiples vulnerabilidades en Copeland XWEB y XWEB Pro (INCIBE-2026-153)
- SentinelOne Vulnerability Database - CVE-2026-25196
- Claroty Team82 Disclosure Dashboard - CVE-2026-25085 (authentication bypass)
- NVD - CVE-2026-25196
Detection coverage for TL-2026-3586
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3586 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.