An OS command injection vulnerability in Copeland XWEB Pro products allows authenticated attackers to execute arbitrary code, posing a critical risk to system integrity.

This is an OS command injection vulnerability (CWE-78) triggered by injecting malicious input into the templates route. The attack requires the user to be authenticated to the system.

The ability to achieve remote code execution provides an attacker with full control over the affected XWEB Pro units. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to unauthorized data access, system disruption, or lateral movement within industrial control environments.

Immediate Action: Update the XWEB Pro firmware to the latest version by visiting the official Copeland software update portal or by using the system update feature available in the unit menu under SYSTEM, Updates, Network.

Proactive Monitoring: Review system access logs for unusual activity associated with the templates route or unexpected process execution spawned by the web service.

Compensating Controls: Restrict network access to the XWEB Pro web interface to known management IP addresses and ensure that only authorized personnel have valid credentials to access the administrative dashboard.

Public Exploit Available: Unknown

Copeland XWEB Pro systems are critical components that require immediate attention. Administrators must prioritize the application of the vendor-provided security updates to eliminate the command injection vector. Failure to remediate could allow an attacker with valid credentials to compromise the entire system, leading to severe operational impacts.