CVSS 3.1
6.6 mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2026-25195
Medium (6.6) in copeland. EPSS 1.6% chance of exploitation in the next 30 days.
An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted firmware update file via the firmware update route.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- copeland:xweb_300d_pro_firmware
- copeland:xweb_500b_pro_firmware
- copeland:xweb_500d_pro_firmware