Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25721)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506219);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/15");

  script_cve_id("CVE-2026-25721");
  script_xref(name:"ICSA", value:"26-057-10");

  script_name(english:"Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25721)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An OS Command injection vulnerability exists in XWEB Pro version
1.12.1 and prior, enabling an authenticated attacker to achieve remote
code execution on the system by injecting malicious input into the
server username and/or password fields of the restore action in the
API V1 route.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://claroty.com/team82/research/chilling-discoveries-unpacking-vulnerabilities-in-copeland-xweb-pro-controllers
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?520e075b");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10");
  script_set_attribute(attribute:"see_also", value:"https://www.copeland.com/en-us/product-security-resources");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25721");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_300d_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_500d_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_500b_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_pro_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Copeland");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Copeland');

var asset = tenable_ot::assets::get(vendor:'Copeland');

var vuln_cpes = {
    "cpe:/o:copeland:xweb_300d_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_500d_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_500b_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);