OS Command Injection Vulnerability in XWEB Pro by Dixell
CVE-2026-24663

9CRITICAL

Key Information:

Vendor

Copeland

Status
Copeland Xweb 300d Pro
Copeland Xweb 500d Pro
Copeland Xweb 500b Pro
Vendor
CVE Published:
27 February 2026

What is CVE-2026-24663?

The XWEB Pro software by Dixell is susceptible to an OS command injection vulnerability found in versions up to 1.12.1. This security flaw allows unauthenticated attackers to execute arbitrary code on the affected system by crafting a malicious request targeting the libraries installation route. By injecting harmful input into the request body, attackers can leverage this vulnerability to compromise the system's security, potentially leading to unauthorized access and control.

Affected Version(s)

Copeland XWEB 300D PRO 0 <= 1.12.1

Copeland XWEB 500B PRO 0 <= 1.12.1

Copeland XWEB 500D PRO 0 <= 1.12.1

References

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareU...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
.