# CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (<=1.12.1) Enabling Authenticated RCE via Crafted LCD State

> An OS command injection flaw (CWE-78) in Copeland XWEB Pro firmware 1.12.1 and prior (XWEB 300D PRO, 500D PRO, 500B PRO) lets an authenticated attacker achieve remote code execution by configuring a crafted LCD state that is later processed during system setup. It is one of 23 vulnerabilities in CISA advisory ICSA-26-057-10 reported by Claroty Team82; Copeland has released a fix and CISA reports no known public exploitation.

- **Published:** 2026-11-13T05:53:16Z
- **Last reviewed:** 2026-11-13T05:53:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5931
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5931.png
- **ID:** TL-2026-5931
- **Severity:** HIGH (CVSS 8)
- **Category:** ICS_SCADA
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2026-25037

## Description

CVE-2026-25037 is an OS command injection vulnerability in the Copeland XWEB Pro supervisory controller web management software, versions 1.12.1 and prior, on the XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO. An authenticated attacker can configure a maliciously crafted LCD state value; that value is stored and then processed later during system setup, where unsanitized input reaches an operating-system command, yielding remote code execution. Per CISA (CVSS v3.1 8.0, AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, CWE-78) the flaw requires high privileges and high attack complexity; NVD's primary score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). NVD published the record on 2026-02-27 and marked it Analyzed (last modified 2026-06-17).

The flaw is part of a batch of 23 vulnerabilities (2 critical, 19 high, 1 medium, 1 low per INCIBE/CISA) disclosed in CISA ICSA-26-057-10 (released 2026-02-26) and credited to Amir Zaltzman of Claroty Team82 (INCIBE also credits Noam Moshe). 19 of the 23 are CWE-78 command injections reached through different routes and fields (firmware update, restore, templates, contacts import, map upload, utility/OpenSSL arguments, Modbus command tool in the debug route, API V1 import/restore, device hostname, Wi-Fi SSID/password, MBird SMS URL, and the LCD state in this CVE). The batch also includes authentication-bypass flaws (CVE-2026-21718, CVE-2026-25085) and an unauthenticated command injection (CVE-2026-24663). Secondary reporting (CybersecurityNews 2026-08-11, RefIndustry 2026-08-13) describes CVE-2026-25085 as a Lua middleware logic error where an unrecognized authentication mode returns an empty table that evaluates as true, and CVE-2026-21718 as admin SSH/web passwords derived from the current date, device MAC address and hard-coded firmware keys. Chained with command-injection flaws these give root-level code execution; Team82 demonstrated on an XWEB Pro connected to an XR60CX field controller over serial Modbus (RS485) that displayed temperature could be altered and cooling fans disabled. Note that this demonstration is of the overall flaw set, not specifically of CVE-2026-25037.

Exploitation status: CISA and INCIBE report no known public exploitation, and no public PoC is stated in the sources. Fix: Copeland has released a fix; users update via the Copeland software update page or SYSTEM -> Updates | Network on an internet-connected device. Secondary sources identify firmware 1.13 as the fixed release (the vendor page itself does not state version numbers). Affected sector per CISA: Commercial Facilities, deployed worldwide. No network IOCs (IPs/domains) are published, so BeaconBeagle correlation was not applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T0859 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-25037 XWEB Pro Crafted LCD State Shell Metacharacters (TL-2026-5931) — Exploitation** (`TL-2026-5931-SPL-001`)

Detects HTTP write requests (POST/PUT) to a Copeland XWEB Pro management interface where an LCD state parameter contains shell metacharacters or command-substitution sequences. This is the CVE-2026-25037 (CWE-78) trigger: the value is stored and later processed during system setup, where it reaches an OS command. Behaviour-first, with no reliance on fixed IPs. Requires access or WAF logs that include the query string or request body.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004
- **Data sources:** web_access_logs, waf_http, proxy_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```comment
TL-2026-5931 / CVE-2026-25037 Copeland XWEB Pro crafted LCD state (CWE-78). Requires HTTP logs containing the query string or body (reverse proxy, WAF, or XWEB access log forwarded to Splunk).
```
index=web (sourcetype=access_combined OR sourcetype=waf:http OR sourcetype=pan:threat) (method=POST OR method=PUT OR http_method=POST OR http_method=PUT)
| regex _raw="(?i)lcd[a-z_]{0,16}(=|%3D|:)[^&\s]{0,64}(;|%3B|%7C|%24%28|%24%7B|%60|%26%26|%0A|\x7c|\x24\x28|\x60)"
| eval target=coalesce(dest, dest_ip, host), client=coalesce(src_ip, src, clientip)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uri_path values(status) as status by client, target, http_user_agent
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let XwebAssets = _GetWatchlist('XWEBAssets') | project XwebIP = tostring(SearchKey);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (XwebAssets)
| where RequestMethod in~ ('POST', 'PUT')
| where RequestURL has 'lcd' or AdditionalExtensions has 'lcd'
| where RequestURL matches regex @'(?i)lcd[a-z_]{0,16}(=|%3D|:)[^&\s]{0,64}(;|%3B|%7C|%24%28|%24%7B|%60|%26%26|%0A)'
    or AdditionalExtensions matches regex @'(?i)lcd[a-z_]{0,16}(=|%3D|:)[^&\s]{0,64}(;|%3B|%7C|%24%28|%24%7B|%60|%26%26|%0A)'
| project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceAction, DeviceVendor, DeviceProduct
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Copeland XWEB Pro Crafted LCD State Command Injection Attempt (CVE-2026-25037)
id: 6b1f0c2e-3a47-4d58-9e21-5c8a7d4f1a01
status: experimental
description: Detects HTTP requests to a web management interface carrying an LCD state parameter containing shell metacharacters, the CVE-2026-25037 (CWE-78) trigger in Copeland XWEB Pro <= 1.12.1. Requires web logs that capture query strings (POST bodies need WAF or proxy body logging).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25037
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2026.25037
logsource:
    category: webserver
detection:
    selection_method:
        cs-method:
            - POST
            - PUT
    selection_lcd_query:
        cs-uri-query|contains: 'lcd'
    selection_meta_query:
        cs-uri-query|contains:
            - '%3B'
            - '%7C'
            - '%24%28'
            - '%60'
            - '%26%26'
            - '%0A'
    selection_lcd_uri:
        c-uri|contains: 'lcd'
    selection_meta_uri:
        c-uri|contains:
            - '%3B'
            - '%7C'
            - '%24%28'
            - '%60'
            - '%26%26'
            - '%0A'
    condition: selection_method and ((selection_lcd_query and selection_meta_query) or (selection_lcd_uri and selection_meta_uri))
falsepositives:
    - Administrators legitimately configuring LCD labels with special characters (rare)
    - Vulnerability scanners fuzzing XWEB parameters
level: high

```

**Known false positives:**

- Administrators legitimately configuring LCD labels or display text containing special characters
- Authorised vulnerability scanners or pentest tooling fuzzing XWEB parameters

**Tuning notes:** Scope to XWEB Pro hosts via a lookup. Confirm which log source captures POST bodies (WAF or proxy); query-string-only logs will miss body-delivered payloads. Exclude approved scanner IPs and change windows. Extend the metacharacter set if your logging decodes URL-encoding.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- XWEB Pro Remote Login Followed By Configuration Change (CVE-2026-25037, T1078) — Exploitation (locked: unlock with TL Creds)
- XWEB Pro Syslog Shell Activity With Download or Reverse-Shell Tooling (CVE-2026-25037) — Post-Exploitation (locked: unlock with TL Creds)
- XWEB Pro Unapproved Modbus/TCP Or Internet-Bound Traffic (CVE-2026-25037) — C2 / Lateral Movement (locked: unlock with TL Creds)
- Sigma: XWEB Pro Crafted LCD State Metacharacters (CVE-2026-25037) — Exploitation (locked: unlock with TL Creds)
- Sigma: Shell With Download/Reverse-Shell Arguments From Web Process On XWEB Pro (CVE-2026-25037) — Post-Exploitation (locked: unlock with TL Creds)
- Sigma: XWEB Pro Authentication Mode Manipulation (CVE-2026-25085 Precursor) — Access Setup (locked: unlock with TL Creds)
- XWEB Pro Shell Execution With Download/Reverse-Shell Arguments (CVE-2026-25037) — Post-Exploitation (locked: unlock with TL Creds)
- XWEB Pro Modbus/TCP Write Commands From Supervisory Controller (CVE-2026-25037) — ICS Impact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CISA ICS Advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-25037](https://fr.claroty.com/team82/disclosure-dashboard/cve-2026-25037)
- [NVD - CVE-2026-25037](https://nvd.nist.gov/vuln/detail/CVE-2026-25037)
- [Copeland XWEB System Software Update (vendor fix)](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [CISA CSAF file icsa-26-057-10.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [INCIBE-CERT: Multiples vulnerabilidades en Copeland XWEB y XWEB Pro (INCIBE-2026-153)](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-copeland-xweb-y-xweb-pro)
- [CybersecurityNews: Hackers can turn off refrigeration (Copeland XWEB Pro)](https://cybersecuritynews.com/hackers-can-turn-off-refrigeration/)
- [RefIndustry: Danfoss, Copeland and Trane address controller security vulnerabilities](https://refindustry.com/?p=78759)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5931