Cyber Posture

CVE-2026-20764

HighRCE

Published: 27 February 2026

Published
27 February 2026
Modified
27 February 2026
KEV Added
Patch
CVSS Score 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0004 13.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20764 is a high-severity OS Command Injection (CWE-78) vulnerability in Copeland Xweb 300D Pro Firmware. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates OS command injection by requiring validation of untrusted inputs like the device hostname configuration before processing.

prevent

Addresses the root software flaw through timely remediation and application of vendor-provided updates to eliminate the vulnerability.

prevent

Restricts hostname inputs to only necessary and safe types, reducing opportunities for injecting malicious OS commands.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

OS command injection in a network-accessible configuration interface (likely web-based) enables exploitation of public-facing applications (T1190), remote services (T1210), and direct abuse of command interpreters for RCE (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system…

more

setup, resulting in remote code execution.

Deeper analysisAI

CVE-2026-20764 is an OS command injection vulnerability (CWE-78) in XWEB Pro version 1.12.1 and prior. Published on 2026-02-27, it enables an authenticated attacker to achieve remote code execution on the affected system by supplying malicious input through the device hostname configuration, which is subsequently processed during system setup.

The vulnerability has a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating exploitation over the network with high attack complexity and requiring high privileges, but no user interaction. A suitably privileged authenticated attacker can inject OS commands via the hostname field to execute arbitrary code remotely during setup processes.

CISA ICS Advisory ICSA-26-057-10 and the vendor's system software update page provide further details on mitigations. Additional resources are available at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json, https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate, and https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10.

Details

CWE(s)

Affected Products

copeland
xweb 300d pro firmware
≤ 1.12.1
copeland
xweb 500d pro firmware
≤ 1.12.1
copeland
xweb 500b pro firmware
≤ 1.12.1

CVEs Like This One

CVE-2026-24695Same product: Copeland Xweb 300D Pro
CVE-2026-20910Same product: Copeland Xweb 300D Pro
CVE-2026-24663Same product: Copeland Xweb 300D Pro
CVE-2026-20742Same product: Copeland Xweb 300D Pro
CVE-2026-25105Same product: Copeland Xweb 300D Pro
CVE-2026-21389Same product: Copeland Xweb 300D Pro
CVE-2026-25109Same product: Copeland Xweb 300D Pro
CVE-2026-24689Same product: Copeland Xweb 300D Pro
CVE-2026-24452Same product: Copeland Xweb 300D Pro
CVE-2026-25721Same product: Copeland Xweb 300D Pro

References