Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-3037)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506232);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/15");

  script_cve_id("CVE-2026-3037");
  script_xref(name:"ICSA", value:"26-057-10");

  script_name(english:"Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-3037)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An OS Command injection vulnerability exists in XWEB Pro version
1.12.1 and prior, enabling an authenticated attacker to achieve remote
code execution on the system by modifying malicious input injected
into the MBird SMS service URL and/or code via the utility route which
is later processed during system setup, leading to remote code
execution.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10");
  script_set_attribute(attribute:"see_also", value:"https://www.copeland.com/en-us/product-security-resources");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-3037");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_300d_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_500d_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_500b_pro_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:copeland:xweb_pro_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Copeland");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Copeland');

var asset = tenable_ot::assets::get(vendor:'Copeland');

var vuln_cpes = {
    "cpe:/o:copeland:xweb_300d_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_500d_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_500b_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"},
    "cpe:/o:copeland:xweb_pro_firmware" :
        {"versionEndExcluding" : "1.13", "family" : "XWEBPro"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);