CVE-2026-25196: OS Command Injection in Copeland XWEB Pro (1.12.1 and prior) via Wi-Fi SSID/Password Fields

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6035 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: XWEB Pro Wi-Fi SSID/Password Command Injection — Exploitation (CVE-2026-25196)

Flags requests to Wi-Fi configuration routes of Copeland XWEB 300D/500D/500B PRO (firmware <= 1.12.1) where the SSID or password parameter carries encoded shell metacharacters (; | && $( ${ backtick newline). This is the documented CVE-2026-25196 CWE-78 vector; command execution occurs when the Wi-Fi configuration is applied.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T0807
• Data sources: web_access_logs, waf, reverse_proxy
• Severity: high
• Confidence: medium

Splunk SPL

```CVE-2026-25196 TL-2026-6035 Copeland XWEB Pro Wi-Fi SSID/password OS command injection (CWE-78)```
index=web sourcetype=access_combined earliest=-24h
| eval target=lower(coalesce(uri_path, uri, ""))
| eval payload=lower(coalesce(uri_query, form_data, ""))
| where match(target, "(wifi|wlan|wireless)") AND match(payload, "(ssid|psk|passw)")
| where match(payload, "(%3b|%7c|%26%26|%24%28|%24%7b|%60|%0a)")
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(status) as http_status by clientip, host, user
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen clientip host user paths http_status hits

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend Payload = tolower(strcat(RequestURL, " ", RequestContext))
| where Payload matches regex "(wifi|wlan|wireless)" and Payload has_any ("ssid", "psk", "passw")
| where Payload contains_any ("%3b", "%7c", "%26%26", "%24%28", "%24%7b", "%60", "%0a", "$(", "${", "`")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 5) by SourceIP, DestinationIP, DestinationHostName, SourceUserName
| project FirstSeen, LastSeen, SourceIP, SourceUserName, DestinationIP, DestinationHostName, Hits, Urls

Sigma

title: Copeland XWEB Pro Wi-Fi SSID/Password Shell Metacharacter Injection (CVE-2026-25196)
id: 6f1d2a3c-8b47-4e5a-9c10-3a7d5e2b91f4
status: experimental
description: Detects web requests to Wi-Fi configuration routes whose SSID or password parameters contain shell metacharacters or command substitution, the injection vector of CVE-2026-25196 in Copeland XWEB Pro firmware 1.12.1 and prior.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25196
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - cve.2026.25196
logsource:
    category: webserver
detection:
    selection_route:
        cs-uri-stem|contains:
            - 'wifi'
            - 'wlan'
            - 'wireless'
    selection_param:
        cs-uri-query|contains:
            - 'ssid'
            - 'psk'
            - 'passw'
    selection_meta:
        cs-uri-query|contains:
            - '%3b'
            - '%7c'
            - '%26%26'
            - '%24%28'
            - '%24%7b'
            - '%60'
            - '%0a'
            - '$('
            - '${'
            - '`'
    condition: selection_route and selection_param and selection_meta
falsepositives:
    - SSIDs or passwords that legitimately contain shell special characters
    - Vulnerability scanners probing Wi-Fi routes
level: high

Known false positives:

• Operators who legitimately use ; | or & in SSID or passphrase values
• Authorized vulnerability scanning or penetration testing against the management interface

Tuning notes: Scope to XWEB Pro hosts via host/site or an asset lookup. Route names are not published in the advisory: adjust the wifi|wlan|wireless pattern to the real route seen in your logs. Form-body data requires WAF/proxy body logging (form_data field); GET-only access logs miss POST payloads. Exclude scanner source IPs.

• 🔒 XWEB Pro Command Injection With Shell/Downloader Tokens — Any Route (CWE-78 Family) · unlock with TL Creds
• 🔒 XWEB Pro Valid-Account Login Then Wi-Fi Config Change From Unlisted Source · unlock with TL Creds
• 🔒 XWEB Pro Asset Periodic Beaconing to External Host — C2 Interval Analysis · unlock with TL Creds
• 🔒 XWEB Pro Wi-Fi Configuration Change From Public IP — Internet-Exposed Exploitation Path · unlock with TL Creds
• 🔒 Web Service Spawning Shell With Downloader Arguments — XWEB Pro Process Telemetry · unlock with TL Creds
• 🔒 XWEB Pro Asset Remote-Service Connections To Internal Hosts — Lateral Movement · unlock with TL Creds
• 🔒 XWEB Pro Device Shell/Downloader Commands in Syslog — Post-Exploitation · unlock with TL Creds
• 🔒 XWEB Pro Asset Outbound Internet Connections — C2 / Payload Retrieval · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-6035.

Technical analysis

Copeland has released a fix; CISA reports no known public exploitation.

CVE-2026-25196 affects the web-management firmware of Copeland XWEB Pro devices (XWEB 300D PRO, XWEB 500D PRO, XWEB 500B PRO), versions 1.12.1 and earlier. Input supplied to the Wi-Fi SSID and/or password configuration fields is not neutralized before it is used in an operating-system command, so an authenticated user can inject arbitrary shell commands that execute when the Wi-Fi configuration is processed/applied (CWE-78).

The flaw was reported to CISA by Amir Zaltzman of Claroty Team82 and published on 2026-02-26/27 as part of CISA ICS advisory ICSA-26-057-10 (Copeland XWEB and XWEB Pro), which bundles 23 CVEs affecting the same three models. Eighteen of those CVEs are CWE-78 command injections in different routes or fields (contacts import, restore, templates, firmware update, utility/debug routes, hostname, LCD state, SMS service settings and others); the set also includes unauthenticated authentication bypass (CVE-2026-21718, CVSS 10.0; CVE-2026-25085) and an unauthenticated command injection (CVE-2026-24663, CVSS 9.0). Because these sibling flaws include authentication bypasses, the authentication requirement for CVE-2026-25196 may be weakened where the sibling issues are unpatched; the sources do not describe a combined exploit chain, so this is a defensive consideration rather than a documented attack.

Scoring differs by source. CISA (ICS-CERT CNA) scores it CVSS 3.1 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), while NVD's primary score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC assessment is Exploitation: none, Automatable: no, Technical Impact: total. No public proof-of-concept, malware, threat-actor attribution, or network indicators were identified in any source. Remediation is to update XWEB Pro to the latest version from Copeland's software update page, or in-device via SYSTEM -- Updates | Network when the device has internet access, and to keep control-system devices off the internet behind firewalls/VPN.

MITRE ATT&CK techniques by tactic:

Execution

T0807 Command-Line Interface; T1059 Command and Scripting Interpreter

persistence

T0859 Valid Accounts

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Privilege Escalation

T1078 Valid Accounts

Remediation

Patches

• Copeland XWEB Pro system software update via https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
• In-device update: SYSTEM -- Updates | Network (requires internet access)

Immediate actions

• Update XWEB 300D PRO, 500D PRO and 500B PRO to the latest Copeland firmware (all versions 1.12.1 and prior are affected)
• Remove XWEB Pro management interfaces from direct internet exposure
• Review accounts with access to the XWEB Pro web interface and rotate credentials

Workarounds

• Restrict network access to the XWEB Pro management interface to trusted administrative hosts
• Monitor Wi-Fi configuration changes on XWEB Pro devices for shell metacharacters in SSID/password values

Longer-term hardening

• Place control system networks and remote devices behind firewalls, isolated from business networks
• Use up-to-date VPNs for remote access to control system devices
• Perform impact analysis and risk assessment before deploying defensive measures
• Follow CISA defense-in-depth guidance and ICS-TIP-12-146-01B for targeted intrusion detection and mitigation

Affected and fixed versions

• Copeland — XWEB 300D PRO
  Vulnerable versions: <= 1.12.1
  Fixed in: Latest XWEB Pro release from Copeland
• Copeland — XWEB 500D PRO
  Vulnerable versions: <= 1.12.1
  Fixed in: Latest XWEB Pro release from Copeland
• Copeland — XWEB 500B PRO
  Vulnerable versions: <= 1.12.1
  Fixed in: Latest XWEB Pro release from Copeland

Timeline

• 2026-02-26 Amir Zaltzman of Claroty Team82 credited with reporting the vulnerabilities to CISA
• 2026-02-26 Copeland has released fixes; users advised to update XWEB Pro via the vendor software update page or SYSTEM -- Updates | Network
• 2026-02-26 CISA releases ICS advisory ICSA-26-057-10 (Copeland XWEB and XWEB Pro), covering 23 CVEs including CVE-2026-25196; Copeland fix referenced; no known public exploitation reported
• 2026-02-27 MITRE CVE record for CVE-2026-25196 published (2026-02-27T00:58Z) by the CISA-ICS CNA, crediting Amir Zaltzman and Noam Moshe of Claroty Team82 and listing the Copeland update page, CISA advisory and CSAF file as references
• 2026-02-27 CVE-2026-25196 published in NVD with CISA CVSS 3.1 score 8.0 and CWE-78
• 2026-03-02 CVE record updated (2026-03-02T14:27Z) with CISA ADP enrichment: SSVC Exploitation none, Automatable no, Technical Impact total
• 2026-06-17 NVD record last modified and marked Analyzed, adding NVD primary CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CISA SSVC (Exploitation none, Automatable no, Technical Impact total)

Sources cited

• CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro CISA · Government advisory · 2026-02-26
• NVD - CVE-2026-25196 NVD (NIST) · Advisory · 2026-02-27
• INCIBE-CERT early warning - CVE-2026-25196 incibe.es · Advisory
• CVE Record - CVE-2026-25196 (MITRE CVE AWG) MITRE · Advisory · 2026-02-27
• Claroty Team82 Disclosure Dashboard - CVE-2026-25196 es.claroty.com · Research
• Copeland XWEB Pro System Software Update (vendor fix) webapps.copeland.com · Vendor report
• CWE-78: OS Command Injection MITRE · Research
• CISA CSAF file icsa-26-057-10 GitHub · Code repository · 2026-02-26

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws
• UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild
• LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)

Related coverage of this activity

• Copeland XWEB Pro RCE

Other reports on CVE-2026-25196

• CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (XWEB 300D/500D/500B PRO) Enabling Authenticated RCE

Previous and next in vulnerability

• CVE-2026-21654: Pre-Authentication OS Command Injection in Johnson Controls Frick Controls Quantum HD (10.22 through 11) Previous report
• Lenovo ThinkSystem V4 XCC3 Firmware Restores Default OpenBMC Root Credentials After Reset to Default (CVE-2026-81936) Next report