# CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)

> Claroty Team82 disclosed an authenticated OS command injection (CWE-78) in Copeland XWEB 300D PRO, 500D PRO and 500B PRO (firmware <= 1.12.1) where malicious input in the Wi-Fi SSID and/or password fields yields remote code execution. CISA ICSA-26-057-10 covers 23 CVEs in these products and reports no known public exploitation.

- **Published:** 2026-10-15T04:34:40Z
- **Last reviewed:** 2026-10-15T04:34:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3586
- **ID:** TL-2026-3586
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25196, CVE-2026-25085

## Description

CVE-2026-25196 is an OS command injection vulnerability (CWE-78) in the web management software of Copeland XWEB Pro controllers (XWEB 300D PRO, 500D PRO, 500B PRO), firmware version 1.12.1 and earlier. An authenticated attacker who can reach the management interface can inject shell metacharacters into the Wi-Fi SSID and/or password fields processed during Wi-Fi configuration, resulting in arbitrary command execution on the device. SentinelOne's vulnerability database attributes the root cause to insufficient input validation and sanitization in the Wi-Fi configuration processing routine.

Scoring differs by source: CISA (CNA/ICS-CERT) assigns CVSS v3.1 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), while NVD lists 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This platform records the CISA score of 8.0. SentinelOne lists EPSS at 0.14% and Known Exploited: No.

The flaw is one of 23 vulnerabilities in the same product line reported by Claroty Team82 researchers Amir Zaltzman and Noam Moshe (2 critical, 19 high, 1 medium, 1 low) and published in CISA ICSA-26-057-10 on 2026-02-26. The set includes CVE-2026-21718 (CVSS 10.0, CWE-327, pre-authenticated code execution via authentication bypass), CVE-2026-24663 (CVSS 9.0, unauthenticated RCE via the libraries installation endpoint), CVE-2026-25085 (CVSS 8.6, authentication bypass caused by an unexpected return value from the authentication routine being treated as legitimate), about 18 further authenticated command-injection flaws across routes such as contacts import, restore, templates, firmware update, parameters, utility, devices, API v1, Wi-Fi configuration, LCD state and hostname configuration, plus CVE-2026-22877 (unauthenticated path traversal / arbitrary file read) and CVE-2026-20797 (adjacent-network stack buffer overflow). The unauthenticated authentication-bypass and RCE flaws can plausibly be chained with the authenticated injection bugs; this chaining is an analytic inference, not something stated by the sources.

No public PoC or in-the-wild exploitation has been confirmed in the sources reviewed; CISA states no known public exploitation specifically targeting these vulnerabilities has been reported. Copeland XWEB Pro devices are web management front-ends for commercial refrigeration and building controllers, so compromise of the device may expose the connected OT environment. Remediation is to update to the latest XWEB Pro software via Copeland's software update page or SYSTEM > Updates | Network on internet-connected units.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T0819 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T0859 Valid Accounts
- T1059 Command and Scripting Interpreter
- T0807 Command-Line Interface

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-25196](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-25196)
- [CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [Copeland System Software Update (vendor fix)](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [CISA CSAF file for ICSA-26-057-10](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [INCIBE-CERT: Multiples vulnerabilidades en Copeland XWEB y XWEB Pro (INCIBE-2026-153)](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-copeland-xweb-y-xweb-pro)
- [SentinelOne Vulnerability Database - CVE-2026-25196](https://www.sentinelone.com/vulnerability-database/cve-2026-25196/)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-25085 (authentication bypass)](https://claroty.com/team82/disclosure-dashboard/cve-2026-25085)
- [NVD - CVE-2026-25196](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-25196)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3586