CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (<=1.12.1) Enabling Authenticated RCE via Crafted LCD State

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5931 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-25037 XWEB Pro Crafted LCD State Shell Metacharacters (TL-2026-5931) — Exploitation

Detects HTTP write requests (POST/PUT) to a Copeland XWEB Pro management interface where an LCD state parameter contains shell metacharacters or command-substitution sequences. This is the CVE-2026-25037 (CWE-78) trigger: the value is stored and later processed during system setup, where it reaches an OS command. Behaviour-first, with no reliance on fixed IPs. Requires access or WAF logs that include the query string or request body.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.004
• Data sources: web_access_logs, waf_http, proxy_logs
• Severity: high
• Confidence: high

Splunk SPL

```comment
TL-2026-5931 / CVE-2026-25037 Copeland XWEB Pro crafted LCD state (CWE-78). Requires HTTP logs containing the query string or body (reverse proxy, WAF, or XWEB access log forwarded to Splunk).
```
index=web (sourcetype=access_combined OR sourcetype=waf:http OR sourcetype=pan:threat) (method=POST OR method=PUT OR http_method=POST OR http_method=PUT)
| regex _raw="(?i)lcd[a-z_]{0,16}(=|%3D|:)[^&\s]{0,64}(;|%3B|%7C|%24%28|%24%7B|%60|%26%26|%0A|\x7c|\x24\x28|\x60)"
| eval target=coalesce(dest, dest_ip, host), client=coalesce(src_ip, src, clientip)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uri_path values(status) as status by client, target, http_user_agent
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let XwebAssets = _GetWatchlist('XWEBAssets') | project XwebIP = tostring(SearchKey);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (XwebAssets)
| where RequestMethod in~ ('POST', 'PUT')
| where RequestURL has 'lcd' or AdditionalExtensions has 'lcd'
| where RequestURL matches regex @'(?i)lcd[a-z_]{0,16}(=|%3D|:)[^&\s]{0,64}(;|%3B|%7C|%24%28|%24%7B|%60|%26%26|%0A)'
    or AdditionalExtensions matches regex @'(?i)lcd[a-z_]{0,16}(=|%3D|:)[^&\s]{0,64}(;|%3B|%7C|%24%28|%24%7B|%60|%26%26|%0A)'
| project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceAction, DeviceVendor, DeviceProduct
| order by TimeGenerated desc

Sigma

title: Copeland XWEB Pro Crafted LCD State Command Injection Attempt (CVE-2026-25037)
id: 6b1f0c2e-3a47-4d58-9e21-5c8a7d4f1a01
status: experimental
description: Detects HTTP requests to a web management interface carrying an LCD state parameter containing shell metacharacters, the CVE-2026-25037 (CWE-78) trigger in Copeland XWEB Pro <= 1.12.1. Requires web logs that capture query strings (POST bodies need WAF or proxy body logging).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25037
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2026.25037
logsource:
    category: webserver
detection:
    selection_method:
        cs-method:
            - POST
            - PUT
    selection_lcd_query:
        cs-uri-query|contains: 'lcd'
    selection_meta_query:
        cs-uri-query|contains:
            - '%3B'
            - '%7C'
            - '%24%28'
            - '%60'
            - '%26%26'
            - '%0A'
    selection_lcd_uri:
        c-uri|contains: 'lcd'
    selection_meta_uri:
        c-uri|contains:
            - '%3B'
            - '%7C'
            - '%24%28'
            - '%60'
            - '%26%26'
            - '%0A'
    condition: selection_method and ((selection_lcd_query and selection_meta_query) or (selection_lcd_uri and selection_meta_uri))
falsepositives:
    - Administrators legitimately configuring LCD labels with special characters (rare)
    - Vulnerability scanners fuzzing XWEB parameters
level: high

Known false positives:

• Administrators legitimately configuring LCD labels or display text containing special characters
• Authorised vulnerability scanners or pentest tooling fuzzing XWEB parameters

Tuning notes: Scope to XWEB Pro hosts via a lookup. Confirm which log source captures POST bodies (WAF or proxy); query-string-only logs will miss body-delivered payloads. Exclude approved scanner IPs and change windows. Extend the metacharacter set if your logging decodes URL-encoding.

• 🔒 XWEB Pro Remote Login Followed By Configuration Change (CVE-2026-25037, T1078) — Exploitation · unlock with TL Creds
• 🔒 XWEB Pro Syslog Shell Activity With Download or Reverse-Shell Tooling (CVE-2026-25037) — Post-Exploitation · unlock with TL Creds
• 🔒 XWEB Pro Unapproved Modbus/TCP Or Internet-Bound Traffic (CVE-2026-25037) — C2 / Lateral Movement · unlock with TL Creds
• 🔒 Sigma: XWEB Pro Crafted LCD State Metacharacters (CVE-2026-25037) — Exploitation · unlock with TL Creds
• 🔒 Sigma: Shell With Download/Reverse-Shell Arguments From Web Process On XWEB Pro (CVE-2026-25037) — Post-Exploitation · unlock with TL Creds
• 🔒 Sigma: XWEB Pro Authentication Mode Manipulation (CVE-2026-25085 Precursor) — Access Setup · unlock with TL Creds
• 🔒 XWEB Pro Shell Execution With Download/Reverse-Shell Arguments (CVE-2026-25037) — Post-Exploitation · unlock with TL Creds
• 🔒 XWEB Pro Modbus/TCP Write Commands From Supervisory Controller (CVE-2026-25037) — ICS Impact · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5931.

Technical analysis

It is one of 23 vulnerabilities in CISA advisory ICSA-26-057-10 reported by Claroty Team82; Copeland has released a fix and CISA reports no known public exploitation.

CVE-2026-25037 is an OS command injection vulnerability in the Copeland XWEB Pro supervisory controller web management software, versions 1.12.1 and prior, on the XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO. An authenticated attacker can configure a maliciously crafted LCD state value; that value is stored and then processed later during system setup, where unsanitized input reaches an operating-system command, yielding remote code execution. Per CISA (CVSS v3.1 8.0, AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, CWE-78) the flaw requires high privileges and high attack complexity; NVD's primary score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). NVD published the record on 2026-02-27 and marked it Analyzed (last modified 2026-06-17).

The flaw is part of a batch of 23 vulnerabilities (2 critical, 19 high, 1 medium, 1 low per INCIBE/CISA) disclosed in CISA ICSA-26-057-10 (released 2026-02-26) and credited to Amir Zaltzman of Claroty Team82 (INCIBE also credits Noam Moshe). 19 of the 23 are CWE-78 command injections reached through different routes and fields (firmware update, restore, templates, contacts import, map upload, utility/OpenSSL arguments, Modbus command tool in the debug route, API V1 import/restore, device hostname, Wi-Fi SSID/password, MBird SMS URL, and the LCD state in this CVE). The batch also includes authentication-bypass flaws (CVE-2026-21718, CVE-2026-25085) and an unauthenticated command injection (CVE-2026-24663). Secondary reporting (CybersecurityNews 2026-08-11, RefIndustry 2026-08-13) describes CVE-2026-25085 as a Lua middleware logic error where an unrecognized authentication mode returns an empty table that evaluates as true, and CVE-2026-21718 as admin SSH/web passwords derived from the current date, device MAC address and hard-coded firmware keys. Chained with command-injection flaws these give root-level code execution; Team82 demonstrated on an XWEB Pro connected to an XR60CX field controller over serial Modbus (RS485) that displayed temperature could be altered and cooling fans disabled. Note that this demonstration is of the overall flaw set, not specifically of CVE-2026-25037.

Exploitation status: CISA and INCIBE report no known public exploitation, and no public PoC is stated in the sources. Fix: Copeland has released a fix; users update via the Copeland software update page or SYSTEM -> Updates | Network on an internet-connected device. Secondary sources identify firmware 1.13 as the fixed release (the vendor page itself does not state version numbers). Affected sector per CISA: Commercial Facilities, deployed worldwide. No network IOCs (IPs/domains) are published, so BeaconBeagle correlation was not applicable.

MITRE ATT&CK techniques by tactic:

Persistence

T0859 Valid Accounts

Execution

T1059.004 Unix Shell

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Remediation

Patches

• Copeland XWEB Pro system software update (secondary sources cite firmware 1.13): https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate

Immediate actions

• Update XWEB 300D PRO / 500D PRO / 500B PRO to the fixed release via the Copeland software update page or SYSTEM -> Updates | Network
• Remove XWEB Pro management interfaces from direct internet exposure
• Review accounts with access to XWEB Pro configuration and rotate administrator credentials

Workarounds

• Restrict network access to the XWEB Pro web interface to trusted management hosts only
• Monitor and alert on configuration changes to LCD, hostname, Wi-Fi and firmware-update settings

Longer-term hardening

• Place control system networks and remote devices behind firewalls, isolated from business networks
• Use patched VPNs or equivalent secure methods for remote access
• Segment refrigeration/HVAC controller networks from other systems
• Perform impact analysis and risk assessment before deploying defensive measures

Affected and fixed versions

• Copeland — XWEB 300D PRO
  Vulnerable versions: <=1.12.1
  Fixed in: Latest release via Copeland update page (1.13 per secondary reporting)
• Copeland — XWEB 500D PRO
  Vulnerable versions: <=1.12.1
  Fixed in: Latest release via Copeland update page (1.13 per secondary reporting)
• Copeland — XWEB 500B PRO
  Vulnerable versions: <=1.12.1
  Fixed in: Latest release via Copeland update page (1.13 per secondary reporting)

Timeline

• 2026-02-26 CISA releases ICS advisory ICSA-26-057-10 (Copeland XWEB and XWEB Pro) covering 23 vulnerabilities including CVE-2026-25037, reported by Amir Zaltzman of Claroty Team82
• 2026-02-27 Copeland fix available via software update page / SYSTEM -> Updates | Network, referenced by CISA and NVD as of publication (exact vendor release date not stated)
• 2026-02-27 INCIBE-CERT publishes INCIBE-2026-153 for Copeland XWEB and XWEB Pro, crediting Amir Zaltzman and Noam Moshe of Claroty Team82; no exploitation reported
• 2026-02-27 NVD publishes CVE-2026-25037 (NVD primary CVSS 3.1 score 8.8; CISA ICS-CERT secondary score 8.0; CWE-78)
• 2026-06-17 NVD record for CVE-2026-25037 last modified; status Analyzed
• 2026-08-11 CybersecurityNews reports Team82 findings on XWEB300D/500D PRO (23 vulnerabilities, fixed in firmware 1.13) with refrigeration manipulation demo
• 2026-08-13 RefIndustry reports Team82 XWEB Pro research, including serial Modbus demo against an XR60CX field controller

Sources cited

• CISA ICS Advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro CISA · Government advisory · 2026-02-26
• NVD - CVE-2026-25037 NVD (NIST) · Advisory · 2026-02-27
• INCIBE-CERT: Multiples vulnerabilidades en Copeland XWEB y XWEB Pro (INCIBE-2026-153) incibe.es · Advisory · 2026-02-27
• Claroty Team82 Disclosure Dashboard - CVE-2026-25037 fr.claroty.com · Research
• Copeland XWEB System Software Update (vendor fix) webapps.copeland.com · Vendor report
• CISA CSAF file icsa-26-057-10.json GitHub · Code repository · 2026-02-26
• CybersecurityNews: Hackers can turn off refrigeration (Copeland XWEB Pro) cybersecuritynews.com · News · 2026-08-11
• RefIndustry: Danfoss, Copeland and Trane address controller security vulnerabilities refindustry.com · News · 2026-08-13

More in ics scada

• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code Injection via Insufficient Input Validation (Pre-Authentication)
• CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Insufficient Input Validation (Pre-Authentication Code Injection)
• CVE-2026-21658: Pre-Authentication Input Validation / Code Injection Flaw in Johnson Controls Frick Controls Quantum HD (10.22 and earlier, legacy through 11)
• CVE-2026-21659 — Johnson Controls Frick Controls Quantum HD unauthenticated path traversal / local file inclusion leading to arbitrary code execution
• CVE-2025-13901 - Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

Related coverage of this activity

• CVE-2026-25037: OS Command Injection in Copeland XWEB Pro