CVE-2026-21389

CVE-2026-21389 is an OS command injection affecting XWEB Pro

CVE-2026-25721

CVE-2026-25721 affects XWEB Pro ≤ 1.12.1. An authenticated user can exploit OS command injection via the restore action in API V1 by injecting input into the server username and/or password fields, enabling remote code execution. Red Hat and ENISA references corroborate the weakness. Remediation ...

CVE-2026-24663

Summary: CVE-2026-24663 affects XWEB Pro, prior to 1.12.1. An unauthenticated attacker can trigger OS command injection via the libraries installation route by injecting input into the request body, enabling remote code execution. This is supported by Red Hat and NVD entries noting the same descr...

CVE-2026-24689

XWEB Pro vulnerability CVE-2026-24689 is an OS command injection affecting XWEB Pro versions 1.12.1 and earlier. An authenticated attacker can trigger remote code execution by injecting malicious input into the devices field of the firmware update apply action. Affected products include XWEB Pro,...

CVE-2026-25037

CVE-2026-25037 affects Copeland/ XWEB Pro software, with OS command injection in XWEB Pro 1.12.1 and earlier. The vulnerability arises when a specially crafted LCD state is processed during system setup, allowing an authenticated attacker to achieve remote code execution on the affected system. P...

CVE-2026-25105

XWEB Pro is affected by an OS command injection vulnerability (CVE-2026-25105) in versions prior to 1.12.1. The flaw allows an authenticated attacker to achieve remote code execution by injecting malicious input into the Modbus command tool parameters in the debug route. Multiple sources (Red Hat...

CVE-2026-3037

The CVE-2026-3037 entry concerns XWEB Pro, affected through version 1.12.1 and earlier. The connected documents confirm an OS command injection vulnerability that allows an authenticated attacker to achieve remote code execution by injecting malicious input into the MBird SMS service URL and/or c...

CVE-2026-25195

CVE-2026-25195 describes an OS command injection in XWEB Pro (versions 1.12.1 and earlier). The root cause is an attacker-authenticated execution path that accepts a crafted firmware update file via the firmware update route, enabling remote code execution on the system. Multiple sources (NVD, Re...

CVE-2026-20902

Summary of CVE-2026-20902 : An OS command injection vulnerability exists in XWEB Pro

CVE-2026-22877

CVE-2026-22877 affects XWEB Pro 1.12.1 and earlier. The Red Hat, NVD, and CVE records describe an unauthenticated arbitrary file-read vulnerability that could allow attackers to read arbitrary files and potentially trigger a denial-of-service. The exploitation status, affected versions beyond 1.1...

CVE-2026-20797

CVE-2026-20797 affects XWEB Pro (version 1.12.1 and earlier). The vulnerability is a stack-based buffer overflow in an API route that allows unauthenticated attackers to trigger stack corruption and terminate the program. Multiple sources (Red Hat, ENISA EUVD, CVE list, NVD) provide identical des...

CVE-2026-24517

CVE-2026-24517 affects XWEB Pro prior to 1.12.1. An authenticated user can exploit an OS command injection via the firmware update route to achieve remote code execution on affected systems. Root cause: input crafted in firmware update requests leads to command injection. Impact: remote code exec...

CVE-2026-25196

CVE-2026-25196 is an OS command injection affecting XWEB Pro before 1.12.1. An authenticated attacker can achieve remote code execution by supplying malicious input in the Wi‑Fi SSID and/or password fields during configuration processing. Multiple sources (Red Hat, NVD, EUVD, CVE records) describ...

CVE-2026-20910

CVE-2026-20910 describes an OS command injection in XWEB Pro v1.12.1 and earlier. An authenticated attacker can achieve remote code execution by injecting input into the firmware update action's devices field. Affected software: XWEB Pro ≤ 1.12.1. Root cause (as stated): improper handling of inpu...

CVE-2026-20742

CVE-2026-20742 is an OS command injection affecting XWEB Pro prior to 1.12.1. An authenticated attacker can trigger remote code execution by sending crafted input to the templates route. Affected product is XWEB Pro (Copeland XWEB family) with confirmed exposure in versions before 1.12.1. CVSS me...

CVE-2026-20764

CVE-2026-20764 affects Copeland XWEB Pro (versions prior to 1.12.1). An authenticated user can supply malicious input through the device hostname configuration, which is processed during system setup, resulting in OS command injection and remote code execution. Red Hat security notes the same vul...

CVE-2026-24452

CVE-2026-24452 describes an OS command injection in XWEB Pro ≤ 1.12.1. An authenticated attacker can achieve remote code execution by supplying a crafted template file to the /devices route. The vulnerability is documented across multiple sources (NVD, Red Hat, EUVD/ENISA, CVE list) with consiste...

CVE-2026-21718

CVE-2026-21718 affects Copeland XWEB Pro (pre-1.12.1). Multiple sources (NVD, Red Hat, EUVD) describe an authentication bypass that enables pre-authenticated code execution over the network. Theconsistent impact is high/critical (C:H/I:H/A:H) with network access and no privileges required. PT-202...

CVE-2026-24695

Summary: CVE-2026-24695 affects XWEB Pro (pre-1.12.1). An authenticated attacker can trigger an OS command injection to achieve remote code execution by injecting malicious input into OpenSSL argument fields in requests to the utility route. Impact is described as remote code execution with high ...

CVE-2026-25085

Copeland XWEB Pro prior to 1.12.1 is affected by an authentication bypass. The issue stems from the authentication routine returning an unexpected value that is later treated as legitimate, bypassing authentication controls. Affected software is Copeland XWEB Pro (version 1.12.1 and earlier). The...

CVE-2026-25109

CVE-2026-25109 affects XWEB Pro prior to 1.12.1. The vulnerability is an OS command injection in the devices field on the /get setup route, exploitable by an authenticated attacker to achieve remote code execution. Public sources (NVD, Red Hat, EUVD) confirm the impact and vulnerable version rang...

CVE-2026-23702

CVE-2026-23702 affects XWEB Pro (v1.12.1 and earlier). AOS command injection in the API V1 route’s import preconfiguration action allows an authenticated attacker to achieve remote code execution by sending crafted input in the server username field. Impact is high (remote code execution, post-au...

CVE-2026-25111

CVE-2026-25111 concerns an OS command injection in Copeland XWEB Pro prior to 1.12.1. An authenticated attacker can achieve remote code execution by sending crafted input to the restore route, due to insufficient input validation on that endpoint. Affected software is XWEB Pro (versions before 1....