# CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore Action

> An OS command injection flaw (CWE-78) in Copeland XWEB Pro 1.12.1 and prior lets an authenticated attacker execute arbitrary code by injecting input into the server username and/or password fields of the restore action in the API V1 route. It affects XWEB 300D PRO, 500D PRO and 500B PRO; CISA reported no known public exploitation at publication.

- **Published:** 2026-10-15T04:48:31Z
- **Last reviewed:** 2026-10-15T04:48:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3587
- **ID:** TL-2026-3587
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25721

## Description

CVE-2026-25721 is an OS command injection vulnerability (CWE-78) in the web management interface of Copeland XWEB Pro, a commercial-facilities monitoring and control platform. In XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO firmware at version 1.12.1 and earlier, the restore action of the API V1 route passes the server username and/or password fields into an OS command without neutralizing special elements. An authenticated attacker who submits crafted values in those fields can run arbitrary commands on the underlying system, resulting in remote code execution.

The CNA (CISA ICS) scored the issue CVSS v3.1 8.0 HIGH (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting the need for high privileges and non-trivial conditions. NVD's primary analysis scored it 8.8 HIGH (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network reachability of the XWEB management interface and valid credentials, so exposure of the interface and credential hygiene determine real-world risk.

The flaw is one of 23 vulnerabilities in XWEB Pro reported by Amir Zaltzman and Noam Moshe of Claroty Team82 and covered by CISA advisory ICSA-26-057-10. The set includes a CVSS 10.0 pre-authenticated code execution via authentication bypass (CVE-2026-21718, CWE-327), an unauthenticated command injection in library installation (CVE-2026-24663) and an authentication bypass (CVE-2026-25085), plus many authenticated command injections. A separate restore-route injection, CVE-2026-25111, is also in the set. Because pre-authentication flaws exist in the same product, an authenticated-only injection such as this one may be chained with them. That chaining is an analytic inference and is not stated in the sources.

The sources give no public PoC, in-the-wild exploitation, threat actor, malware, C2 infrastructure or network IOCs for this CVE. CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported. The vendor remediation is to update to the latest XWEB Pro software through the Copeland software update page, or through SYSTEM > Updates | Network on internet-connected devices. The sources give no specific fixed version number. CISA also advises minimizing control-system internet exposure, placing networks behind firewalls and using VPNs for remote access.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T0859 Valid Accounts
- T0807 Command-Line Interface

## Sources

- [CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-25721](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-25721)
- [Copeland XWEB System Software Update](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [NVD - CVE-2026-25721](https://nvd.nist.gov/vuln/detail/CVE-2026-25721)
- [CVE.org CVE Record - CVE-2026-25721](https://cveawg.mitre.org/api/cve/CVE-2026-25721)
- [CISA CSAF - icsa-26-057-10.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [EUVD-2026-8979 - CVE-2026-25721](https://vulners.com/euvd/EUVD-2026-8979)
- [Lutra Security Field Guide - CVE-2026-25721](https://fieldguide.lutrasecurity.com/CVE-2026-25721)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3587