Critical severity · published Feb 27, 2026
CVE-2026-25085
Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in
which an unexpected return value from the authentication routine is
later on processed as a legitimate value, resulting in an authentication
bypass.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Copeland XWEB 300D PRO · Copeland
through 1.12.1 · source: vendor
CX
Copeland XWEB 500B PRO · Copeland
through 1.12.1 · source: vendor
CX
Copeland XWEB 500D PRO · Copeland
through 1.12.1 · source: vendor
X3
Xweb 300d Pro Firmware · Copeland
through 1.12.1 · source: NVD
X5
Xweb 500b Pro Firmware · Copeland
through 1.12.1 · source: NVD
X5
Xweb 500d Pro Firmware · Copeland
through 1.12.1 · source: NVD
In the news
AdvisoryMedium
Copeland XWEB and XWEB Pro
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code.
The following versions of Copeland XWEB and XWEB Pro are affected:
XWEB 300D PRO <=1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663, CVE-2026-21389, CVE-2026-25111, CVE-2026-20742, CVE-2026-24517, CVE-2026-25195, CVE-2026-20910, CVE-2026-24689, CVE-2026-25109, CVE-2026-20902, CVE-2026-24695, CVE-2026-25105, CVE-2026-24452, CVE-2026-23702, CVE-2026-25721, CVE-2026-20764, CVE-2026-25196, CVE-2026-25037, CVE-2026-22877, CVE-2026-20797, CVE-2026-3037)
XWEB 500D PRO <=1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663, CVE-2026-21389, CVE-2026-25111, CVE-2026-20742, CVE-2026-24517, CVE-2026-25195, CVE-2026-20910, CVE-2026-24689, CVE-2026-25109, CVE-2026-20902, CVE-2026-24695, CVE-2026-25105, CVE-2026-24452, CVE-2026-23702, CVE-2026-25721, CVE-2026-20764, CVE-2026-25196, CVE-2026-25037, CVE-2026-22877, CVE-2026-20797, CVE-2026-3037)
XWEB 500B PRO <=1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663, CVE-2026-21389, CVE-2026-25111, CVE-2026-20742, CVE-2026-24517, CVE-2026-25195, CVE-2026-20910, CVE-2026-24689, CVE-2026-25109, CVE-2026-20902, CVE-2026-24695, CVE-2026-25105, CVE-2026-24452, CVE-2026-23702, CVE-2026-25721, CVE-2026-20764, CVE-2026-25196, CVE-2026-25037, CVE-2026-22877, CVE-2026-20797, CVE-2026-3037)
CVSS
Vendor ...
Feb 26, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25085
Third Party Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
Product
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
More from Copeland XWEB 300D PRO
9.8
CVE-2026-20797
Copeland XWEB and XWEB Pro Stack-based Buffer Overflow
9.8
CVE-2026-24663
Copeland XWEB and XWEB Pro OS Command Injection
9.8
CVE-2026-21718
Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm
9.1
CVE-2026-22877
Copeland XWEB and XWEB Pro Path Traversal
8.8
CVE-2026-3037
Copeland XWEB and XWEB Pro OS Command Injection