CVE-2026-21389

🗓️ 27 Feb 2026 00:38:51Reported by icscertType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 24 Views

Authenticated OS command injection in Copeland XWEB Pro before 1.12.1 enables remote code execution via the contacts import route request body.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-21389	27 Feb 202600:38	–	attackerkb
Circl	CVE-2026-21389	26 Feb 202611:00	–	circl
CNNVD	Copeland多款产品操作系统命令注入漏洞	27 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-21389 Copeland XWEB and XWEB Pro OS Command Injection	27 Feb 202600:38	–	cvelist
EUVD	EUVD-2026-8946	27 Feb 202603:30	–	euvd
NVD	CVE-2026-21389	27 Feb 202601:16	–	nvd
OSV	CVE-2026-21389	27 Feb 202601:16	–	osv
Positive Technologies	PT-2026-7658	11 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-21389	28 Feb 202601:55	–	redhatcve
Vulnrichment	CVE-2026-21389 Copeland XWEB and XWEB Pro OS Command Injection	27 Feb 202600:38	–	vulnrichment

NVD

Vulners

Node

copeland xweb_300d_pro_firmwareRange≤1.12.1

AND

copeland xweb_300d_proMatch-

Node

copeland xweb_500d_pro_firmwareRange≤1.12.1

AND

copeland xweb_500d_proMatch-

Node

copeland xweb_500b_pro_firmwareRange≤1.12.1

AND

copeland xweb_500b_proMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Copeland XWEB 300D PRO",
    "vendor": "Copeland",
    "versions": [
      {
        "lessThanOrEqual": "1.12.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Copeland XWEB 500D PRO",
    "vendor": "Copeland",
    "versions": [
      {
        "lessThanOrEqual": "1.12.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Copeland XWEB 500B PRO",
    "vendor": "Copeland",
    "versions": [
      {
        "lessThanOrEqual": "1.12.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
webapps	www.webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
cisa	www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
github	www.github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json

17 Jun 2026 10:18Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.18 - 8.8

EPSS0.01489

SSVC

CWE-78