Copeland XWEB Pro OS Command Injection (CVE-2026-23702)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506236);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/15");

  script_cve_id("CVE-2026-23702");
  script_xref(name:"ICSA", value:"26-057-10");

  script_name(english:"Copeland XWEB Pro OS Command Injection (CVE-2026-23702)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An OS Command injection vulnerability exists in XWEB Pro version
1.12.1 and prior, enabling an authenticated attacker to achieve remote
code execution on the system by sending malicious input injected into
the server username field of the import preconfiguration action in the
API V1 route.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://claroty.com/team82/research/chilling-discoveries-unpacking-vulnerabilities-in-copeland-xweb-pro-controllers
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?520e075b");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10");
  script_set_attribute(attribute:"see_also", value:"https://www.copeland.com/en-us/product-security-resources");
  script_set_attribute(attribute:"solution", value:
"Upgrade XWEB Pro to firmware version 1.13 or later. The update is
available from the Copeland software update page
(https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate) or,
on a device with internet access, from the menu SYSTEM -- Updates |
Network.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-23702");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_300d_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_500d_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_500b_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_pro_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Copeland");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Copeland');

var asset = tenable_ot::assets::get(vendor:'Copeland');

var vuln_cpes = {
    "cpe:/o:copeland:xweb_300d_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_500d_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_500b_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);