Copeland
Vulnerability activity for Copeland: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 23
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-3037An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed during system setup, leading to remote code execution.2.1% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-25721An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore action in the API V1 route.2.1% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-25196An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi-Fi SSID and/or password fields can lead to remote code execution when the configuration is processed.2.1% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-25105An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into parameters of the Modbus command tool in the debug route.2.1% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-25037An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution.2.1% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-24452An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route.2.1% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-23702An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by sending malicious input injected into the server username field of the import preconfiguration action in the API V1 route.2.1% likely
- 3.7LowFeb 27, 2026Copeland xweb 300d pro firmware Path traversal / file handlingCVE-2026-22877An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.
- 4.3MediumFeb 27, 2026Copeland xweb 300d pro firmware Memory corruptionCVE-2026-20797A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-20764An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote code execution.2.1% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-25195An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route.1.6% likely
- 8.0HighFeb 27, 2026Copeland xweb 500b pro firmware Code / command injectionCVE-2026-25111An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route.1.7% likely
- 8.0HighFeb 27, 2026Copeland xweb 500b pro firmware Code / command injectionCVE-2026-25109An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route.1.7% likely
- 8.6HighFeb 27, 2026Copeland xweb 500b pro firmwareCVE-2026-25085A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
- 8.0HighFeb 27, 2026Copeland xweb 500b pro firmware Code / command injectionCVE-2026-24695An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into OpenSSL argument fields within requests sent to the utility route, leading to remote code execution.1.7% likely
- 8.0HighFeb 27, 2026Copeland xweb 500b pro firmware Code / command injectionCVE-2026-24689An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update apply action.1.7% likely
- 9.0CriticalFeb 27, 2026Copeland xweb 500b pro firmware Code / command injectionCVE-2026-24663An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.3.7% likely
- 8.0HighFeb 27, 2026Copeland xweb 500b pro firmware Code / command injectionCVE-2026-24517An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route.1.8% likely
- 10.0CriticalFeb 27, 2026Copeland xweb 300d pro firmware Crypto / certificateCVE-2026-21718An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-21389An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.1.7% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-20910An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.1.7% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-20902An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route.1.7% likely
- 8.0HighFeb 27, 2026Copeland xweb 300d pro firmware Code / command injectionCVE-2026-20742An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the templates route.1.7% likely
- 9.8CriticalSep 2, 2025Copeland e3 supervisory controller firmwareCVE-2025-6519E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.
- 7.5HighSep 2, 2025Copeland e3 supervisory controller firmwareCVE-2025-52545E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.
- 7.5HighSep 2, 2025Copeland e3 supervisory controller firmwareCVE-2025-52544E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.
- 7.5HighSep 2, 2025Copeland e3 supervisory controller firmwareCVE-2025-52543E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
Top products
- xweb 300d pro firmware16 CVEs in the last year, 1 critical
- xweb 500b pro firmware7 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.