CVE-2026-24452 Copeland CVE debrief

Who should care

OT/ICS operators running Copeland XWEB Pro, including XWEB 300D PRO, XWEB 500D PRO, and XWEB 500B PRO instances; security teams responsible for industrial management systems; and administrators who allow authenticated users to access the devices route or system update functions.

Technical summary

The advisory describes an OS command injection weakness (CWE-78) in XWEB Pro version 1.12.1 and prior. A successful attack requires authentication and uses a crafted template file sent to the devices route, which can result in remote code execution on the system. The supplied CVSS vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating high impact with high attack complexity and privileged access requirements.

Defensive priority

High priority for OT/ICS environments. Because the issue can lead to remote code execution on a management system and the vendor has already published a fix, remediation should be scheduled immediately for any affected deployment that is reachable by multiple users or connected to broader networks.

Recommended defensive actions

• Upgrade XWEB Pro to the latest Copeland-provided version using the software update page referenced in the advisory.
• If the device has internet access, use the SYSTEM -- Updates | Network path described by Copeland to update directly from Copeland servers.
• Restrict and review authenticated access to XWEB Pro administrative functions, especially routes that accept template files.
• Inventory all XWEB Pro deployments and confirm whether they are at version 1.12.1 or earlier.
• Prioritize remediation on systems that are network-accessible or support critical building/industrial operations.
• Monitor for unexpected administrative activity or file submissions associated with the devices route until systems are updated.

Evidence notes

Source evidence states: "An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route." The advisory metadata includes SSVCv2/E:N/A:N/2026-02-25T07:00:00.000000Z, the CVE and source advisory were published on 2026-02-26T07:00:00.000Z, and the remediation section says Copeland has provided a fix and recommends updating XWEB Pro. The corpus does not include a KEV entry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.