Copeland vulnerabilities
We track 41 vulnerabilities in Copeland products across 8 products. 41 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest Copeland vulnerabilities
- 9.1 Critical severity
XWEB EVO: Missing Authentication for Critical Functionality
XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which perform
- 8.8 High severity
XWEB EVO: Improper Neutralization of Special Elements used in an OS Command
XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command exec
- 8.1 High severity
XWEB EVO: Use of Hard-coded Credentials
XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Adm
- 9.8 Critical severity
XWEB EVO: Improper Neutralization of Special Elements used in an OS Command
XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter,
- 7.2 High severity
XWEB EVO: Improper Neutralization of Special Elements used in an OS Command
XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua.
- 7.2 High severity
XWEB EVO: Improper Neutralization of Special Elements used in an OS Command
XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related she
- 8.1 High severity
XWEB EVO: Improper Neutralization of Special Elements used in an OS Command
XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped int
- 8.1 High severity
XWEB EVO: Use of Hard-coded Credentials
XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credentia
- 8.1 High severity
XWEB EVO: Use of Insufficiently Random Values
XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze t
- 9.8 Critical severity
XWEB EVO: Use of Hard-coded Credentials
XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevon
- 7.8 High severity
XWEB EVO: Execution with Unnecessary Privileges
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitr
- 9.8 Critical severity
XWEB EVO: Improper Neutralization of Special Elements used in an OS Command
XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua,
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utilit
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore act
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi-Fi SSID and/or password fields can lead to remote code
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into parameters of the Modbus command tool in the debug route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, en
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by sending malicious input injected into the server username field of the import preconfigurati
- 9.1 Critical severity
Copeland XWEB 300D PRO: Improper Limitation of a Pathname to a Restricted Directory
An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Out-of-bounds Write
A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed dur
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Unexpected Status Code or Return Value
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into OpenSSL argument fields within requests sent to the utility r
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update apply action.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious inpu
- 7.2 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Use of a Broken or Risky Cryptographic Algorithm
An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve re
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the pa
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the templates route.
- 9.8 Critical severity
E3 Supervisory Control: Insufficiently Protected Credentials
E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.
- 7.2 High severity
E3 Supervisory Control: Improper Verification of Cryptographic Signature
E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.
- 9.8 Critical severity
E3 Supervisory Control: Insufficiently Protected Credentials
E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.
- 7.5 High severity
E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks…
E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.
- 7.5 High severity
E3 Supervisory Control: Insufficiently Protected Credentials
E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.
- 7.5 High severity
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows…
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.