Threat video1:00
CVE-2026-25196 XWEB Wi-Fi SSID Injection: Detection & IOCs
Authenticated users can inject shell commands via XWEB Pro Wi-Fi fields. Patch status, 7 IOCs and 9 detection rules, including a free Splunk SPL query.
Read the full threat intel for CVE-2026-25196 XWEB Wi-Fi SSID Injection: Detection & IOCs →
Chapters
- 0:00The hook23 CVEs in one advisory.
- 0:04The storyClaroty Team82 reported it to CISA.
- 0:11Attack pathCISA: affected firmware up to 1.12.1.
- 0:27AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromise1 indicator to hunt: 1 file name.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to persistence.
- 0:42Remediation3 steps now: Update XWEB 300D PRO, 500D PRO and 500B PRO.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0023 CVEs in one advisory. Update now.
0:05Claroty Team82 reported it to CISA.
0:08Copeland released a fix; update now.
0:11CISA: affected firmware up to 1.12.1.
0:15Exposed interfaces and valid logins widen risk.
0:19Wireless name and password fields: unsanitized.
0:23Applying the saved config triggers it.
0:28No threat actor: this was defensive research.
0:321 indicator to hunt: 1 file name.
0:385 ATT&CK techniques, from initial access to persistence.
0:433 steps now: Update XWEB 300D PRO, 500D PRO and 500B PRO.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.