CVE-2026-20902 Copeland CVE debrief

Who should care

Administrators and operators responsible for Copeland XWEB Pro deployments, especially XWEB 300D PRO, XWEB 500D PRO, and XWEB 500B PRO systems. This matters most where authenticated users can reach the management interface or where the device is exposed to broader enterprise or remote-access networks.

Technical summary

The advisory describes a command-injection weakness in the map upload action, specifically in the map filename field on the parameters route. Exploitation requires an authenticated attacker and no user interaction, but successful abuse can lead to remote code execution with high confidentiality, integrity, and availability impact. The supplied CVSS vector reflects network reachability, high attack complexity, and high privileges required: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.

Defensive priority

High. Patch promptly, with special attention to internet-accessible or remotely administered instances.

Recommended defensive actions

• Update XWEB Pro to the latest vendor-released version using Copeland’s software update path.
• If using direct device updates, verify the target is approved for online update before using SYSTEM → Updates → Network.
• Restrict authenticated access to the XWEB Pro management interface to trusted administrative networks only.
• Review logs and account activity for unusual requests to the parameters route or map upload functions.
• Confirm all deployed instances and versions against the advisory, including XWEB 300D PRO, XWEB 500D PRO, and XWEB 500B PRO.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-057-10, published 2026-02-26 UTC, which states that XWEB Pro version 1.12.1 and prior is vulnerable to OS command injection via the map filename field during the map upload action of the parameters route. The supplied advisory metadata also includes the CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H and points to Copeland’s software update page as the remediation path. No exploitation activity or KEV listing is included in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.