# CVE-2026-25196: OS Command Injection in Copeland XWEB Pro (1.12.1 and prior) via Wi-Fi SSID/Password Fields

> CVE-2026-25196 is an OS command injection (CWE-78) in Copeland XWEB 300D PRO, 500D PRO and 500B PRO firmware 1.12.1 and prior. An authenticated attacker can inject shell commands through the Wi-Fi SSID and/or password fields, giving remote code execution when the configuration is processed. Copeland has released a fix; CISA reports no known public exploitation.

- **Published:** 2026-11-14T04:13:27Z
- **Last reviewed:** 2026-11-14T04:13:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6035
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6035.png
- **ID:** TL-2026-6035
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-25196

## Description

CVE-2026-25196 affects the web-management firmware of Copeland XWEB Pro devices (XWEB 300D PRO, XWEB 500D PRO, XWEB 500B PRO), versions 1.12.1 and earlier. Input supplied to the Wi-Fi SSID and/or password configuration fields is not neutralized before it is used in an operating-system command, so an authenticated user can inject arbitrary shell commands that execute when the Wi-Fi configuration is processed/applied (CWE-78).

The flaw was reported to CISA by Amir Zaltzman of Claroty Team82 and published on 2026-02-26/27 as part of CISA ICS advisory ICSA-26-057-10 (Copeland XWEB and XWEB Pro), which bundles 23 CVEs affecting the same three models. Eighteen of those CVEs are CWE-78 command injections in different routes or fields (contacts import, restore, templates, firmware update, utility/debug routes, hostname, LCD state, SMS service settings and others); the set also includes unauthenticated authentication bypass (CVE-2026-21718, CVSS 10.0; CVE-2026-25085) and an unauthenticated command injection (CVE-2026-24663, CVSS 9.0). Because these sibling flaws include authentication bypasses, the authentication requirement for CVE-2026-25196 may be weakened where the sibling issues are unpatched; the sources do not describe a combined exploit chain, so this is a defensive consideration rather than a documented attack.

Scoring differs by source. CISA (ICS-CERT CNA) scores it CVSS 3.1 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), while NVD's primary score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC assessment is Exploitation: none, Automatable: no, Technical Impact: total. No public proof-of-concept, malware, threat-actor attribution, or network indicators were identified in any source. Remediation is to update XWEB Pro to the latest version from Copeland's software update page, or in-device via SYSTEM -- Updates | Network when the device has internet access, and to keep control-system devices off the internet behind firewalls/VPN.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T0859 Valid Accounts
- T0807 Command-Line Interface

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**XWEB Pro Wi-Fi SSID/Password Command Injection — Exploitation (CVE-2026-25196)** (`TL-2026-6035-SPL-001`)

Flags requests to Wi-Fi configuration routes of Copeland XWEB 300D/500D/500B PRO (firmware <= 1.12.1) where the SSID or password parameter carries encoded shell metacharacters (; | && $( ${ backtick newline). This is the documented CVE-2026-25196 CWE-78 vector; command execution occurs when the Wi-Fi configuration is applied.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T0807
- **Data sources:** web_access_logs, waf, reverse_proxy
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
```CVE-2026-25196 TL-2026-6035 Copeland XWEB Pro Wi-Fi SSID/password OS command injection (CWE-78)```
index=web sourcetype=access_combined earliest=-24h
| eval target=lower(coalesce(uri_path, uri, ""))
| eval payload=lower(coalesce(uri_query, form_data, ""))
| where match(target, "(wifi|wlan|wireless)") AND match(payload, "(ssid|psk|passw)")
| where match(payload, "(%3b|%7c|%26%26|%24%28|%24%7b|%60|%0a)")
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(status) as http_status by clientip, host, user
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen clientip host user paths http_status hits
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend Payload = tolower(strcat(RequestURL, " ", RequestContext))
| where Payload matches regex "(wifi|wlan|wireless)" and Payload has_any ("ssid", "psk", "passw")
| where Payload contains_any ("%3b", "%7c", "%26%26", "%24%28", "%24%7b", "%60", "%0a", "$(", "${", "`")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 5) by SourceIP, DestinationIP, DestinationHostName, SourceUserName
| project FirstSeen, LastSeen, SourceIP, SourceUserName, DestinationIP, DestinationHostName, Hits, Urls
```

### Sigma

```yaml
title: Copeland XWEB Pro Wi-Fi SSID/Password Shell Metacharacter Injection (CVE-2026-25196)
id: 6f1d2a3c-8b47-4e5a-9c10-3a7d5e2b91f4
status: experimental
description: Detects web requests to Wi-Fi configuration routes whose SSID or password parameters contain shell metacharacters or command substitution, the injection vector of CVE-2026-25196 in Copeland XWEB Pro firmware 1.12.1 and prior.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25196
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - cve.2026.25196
logsource:
    category: webserver
detection:
    selection_route:
        cs-uri-stem|contains:
            - 'wifi'
            - 'wlan'
            - 'wireless'
    selection_param:
        cs-uri-query|contains:
            - 'ssid'
            - 'psk'
            - 'passw'
    selection_meta:
        cs-uri-query|contains:
            - '%3b'
            - '%7c'
            - '%26%26'
            - '%24%28'
            - '%24%7b'
            - '%60'
            - '%0a'
            - '$('
            - '${'
            - '`'
    condition: selection_route and selection_param and selection_meta
falsepositives:
    - SSIDs or passwords that legitimately contain shell special characters
    - Vulnerability scanners probing Wi-Fi routes
level: high

```

**Known false positives:**

- Operators who legitimately use ; | or & in SSID or passphrase values
- Authorized vulnerability scanning or penetration testing against the management interface

**Tuning notes:** Scope to XWEB Pro hosts via host/site or an asset lookup. Route names are not published in the advisory: adjust the wifi|wlan|wireless pattern to the real route seen in your logs. Form-body data requires WAF/proxy body logging (form_data field); GET-only access logs miss POST payloads. Exclude scanner source IPs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- XWEB Pro Command Injection With Shell/Downloader Tokens — Any Route (CWE-78 Family) (locked: unlock with TL Creds)
- XWEB Pro Valid-Account Login Then Wi-Fi Config Change From Unlisted Source (locked: unlock with TL Creds)
- XWEB Pro Asset Periodic Beaconing to External Host — C2 Interval Analysis (locked: unlock with TL Creds)
- XWEB Pro Wi-Fi Configuration Change From Public IP — Internet-Exposed Exploitation Path (locked: unlock with TL Creds)
- Web Service Spawning Shell With Downloader Arguments — XWEB Pro Process Telemetry (locked: unlock with TL Creds)
- XWEB Pro Asset Remote-Service Connections To Internal Hosts — Lateral Movement (locked: unlock with TL Creds)
- XWEB Pro Device Shell/Downloader Commands in Syslog — Post-Exploitation (locked: unlock with TL Creds)
- XWEB Pro Asset Outbound Internet Connections — C2 / Payload Retrieval (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-25196](https://es.claroty.com/team82/disclosure-dashboard/cve-2026-25196)
- [NVD - CVE-2026-25196](https://nvd.nist.gov/vuln/detail/CVE-2026-25196)
- [Copeland XWEB Pro System Software Update (vendor fix)](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [CISA CSAF file icsa-26-057-10](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [INCIBE-CERT early warning - CVE-2026-25196](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-25196)
- [CVE Record - CVE-2026-25196 (MITRE CVE AWG)](https://cveawg.mitre.org/api/cve/CVE-2026-25196)
- [CWE-78: OS Command Injection](https://cwe.mitre.org/data/definitions/78.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6035