Stack-Based Buffer Overflow in XWEB Pro by Copeland
CVE-2026-20797

4.3MEDIUM

Key Information:

Vendor

Copeland

Status
Copeland Xweb 300d Pro
Copeland Xweb 500d Pro
Copeland Xweb 500b Pro
Vendor
CVE Published:
27 February 2026

What is CVE-2026-20797?

A significant vulnerability has been identified in XWEB Pro API routes that allows unauthenticated attackers to exploit a stack-based buffer overflow. This flaw can cause stack corruption and may lead to the termination of the program, potentially compromising the integrity and stability of the affected systems. Users of XWEB Pro versions 1.12.1 and earlier should take immediate action to mitigate this risk. Ensure you refer to the latest system software updates from Copeland to protect your deployments.

Affected Version(s)

Copeland XWEB 300D PRO 0 <= 1.12.1

Copeland XWEB 500B PRO 0 <= 1.12.1

Copeland XWEB 500D PRO 0 <= 1.12.1

References

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareU...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
.