Xweb 500b Pro Firmware vulnerabilities
22 known vulnerabilities in Xweb 500b Pro Firmware from Copeland. 22 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utilit
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore act
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi-Fi SSID and/or password fields can lead to remote code
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into parameters of the Modbus command tool in the debug route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, en
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by sending malicious input injected into the server username field of the import preconfigurati
- 9.1 Critical severity
Copeland XWEB 300D PRO: Improper Limitation of a Pathname to a Restricted Directory
An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Out-of-bounds Write
A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed dur
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Unexpected Status Code or Return Value
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into OpenSSL argument fields within requests sent to the utility r
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update apply action.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious inpu
- 7.2 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Use of a Broken or Risky Cryptographic Algorithm
An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve re
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the pa
- 8.8 High severity
Copeland XWEB 300D PRO: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the templates route.