CVE-2026-20764
Published: 27 February 2026
Summary
CVE-2026-20764 is a high-severity OS Command Injection (CWE-78) vulnerability in Copeland Xweb 300D Pro Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates OS command injection by requiring validation of untrusted inputs like the device hostname configuration before processing.
Addresses the root software flaw through timely remediation and application of vendor-provided updates to eliminate the vulnerability.
Restricts hostname inputs to only necessary and safe types, reducing opportunities for injecting malicious OS commands.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in a network-accessible configuration interface (likely web-based) enables exploitation of public-facing applications (T1190), remote services (T1210), and direct abuse of command interpreters for RCE (T1059).
NVD Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system…
more
setup, resulting in remote code execution.
Deeper analysisAI
CVE-2026-20764 is an OS command injection vulnerability (CWE-78) in XWEB Pro version 1.12.1 and prior. Published on 2026-02-27, it enables an authenticated attacker to achieve remote code execution on the affected system by supplying malicious input through the device hostname configuration, which is subsequently processed during system setup.
The vulnerability has a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating exploitation over the network with high attack complexity and requiring high privileges, but no user interaction. A suitably privileged authenticated attacker can inject OS commands via the hostname field to execute arbitrary code remotely during setup processes.
CISA ICS Advisory ICSA-26-057-10 and the vendor's system software update page provide further details on mitigations. Additional resources are available at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json, https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate, and https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10.
Details
- CWE(s)