## Summary
CVE-2026-25037 is an OS command injection in Copeland XWEB Pro firmware <= 1.12.1 that can be used by an authenticated attacker to achieve remote code execution. The issue is triggered by configuring a maliciously crafted LCD state that is later processed during system setup.
## Technical Details
- Vulnerability class: CWE-78 (OS command injection)
- Attack prerequisites (per NVD): an attacker must be authenticated (PR:H, UI:N).
- Trigger mechanism: a maliciously crafted LCD state is configured and then processed during system setup, leading to command injection and remote code execution.
- CVSS indicates network reachability (AV:N) with high impact (C:H/I:H/A:H) and scope change (S:C).
## Affected
- copeland xweb 300d pro firmware <= 1.12.1
- copeland xweb 500d pro firmware <= 1.12.1
- copeland xweb 500b pro firmware <= 1.12.1
## Impact
- Remote code execution on the system during/after system setup when the injected command is processed.
- Potential additional outcomes noted in the related CISA advisory context for affected Copeland XWEB/XWEB Pro versions include authentication bypass and denial-of-service, though the specific CVE-2026-25037 chain is described as command injection leading to RCE.
## Mitigation
1. Patch/upgrade Copeland XWEB Pro firmware to a version that is not <= 1.12.1 (per CISA advisory affected range).
2. Restrict access to the device management/authentication interfaces to reduce the likelihood of an authenticated attacker reaching the vulnerable configuration path.
3. Monitor for suspicious changes to LCD state and subsequent system setup activity, and investigate unexpected configuration updates from authenticated sessions.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-78