A critical OS command injection vulnerability in Copeland XWEB PRO versions 1.12.1 and prior allows authenticated attackers to execute arbitrary code on the system.

The flaw is an OS command injection (CWE-78) triggered by injecting malicious input into parameters of the Modbus command tool within the debug route. Successful exploitation requires an authenticated attacker with high privileges.

This vulnerability carries a CVSS score of 8.0, reflecting its high severity due to the potential for total system compromise. Successful exploitation grants an attacker the ability to execute remote code, which could lead to unauthorized data access, loss of system integrity, and complete operational disruption of the affected industrial control units.

Immediate Action: Update all affected XWEB PRO devices to the latest firmware version via the official Copeland software update portal or directly through the device system menu.

Proactive Monitoring: Review system access logs for unauthorized attempts to access the debug route or unusual activity originating from the Modbus command tool interface.

Compensating Controls: Restrict network access to the XWEB PRO management interface to trusted administrative IP addresses only, and employ a Web Application Firewall to inspect traffic for command injection patterns.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention to prevent potential remote code execution. Administrators should prioritize applying the vendor-supplied firmware updates to all XWEB PRO units and ensure that administrative access to these systems is strictly controlled and monitored to reduce the attack surface.