CVE-2026-20910
Published: 27 February 2026
Summary
CVE-2026-20910 is a high-severity OS Command Injection (CWE-78) vulnerability in Copeland Xweb 300D Pro Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents OS command injection by requiring validation and corrective action on inputs like the devices field in firmware updates to reject malicious payloads.
SI-2 mandates timely remediation of flaws such as CVE-2026-20910 through patching XWEB Pro to eliminate the command injection vulnerability.
CM-5 restricts access to firmware update actions, limiting exploitation opportunities for authenticated high-privilege attackers targeting the vulnerable devices field.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables authenticated RCE via OS command injection in web firmware update interface, directly facilitating T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter).
NVD Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update update action to…
more
achieve remote code execution.
Deeper analysisAI
CVE-2026-20910 is an OS command injection vulnerability (CWE-78) affecting XWEB Pro version 1.12.1 and prior versions. It allows an authenticated attacker to inject malicious input into the devices field of the firmware update action, resulting in remote code execution on the affected system. The vulnerability has a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity with network accessibility, high attack complexity, required high privileges, changed scope, and high impact across confidentiality, integrity, and availability.
An authenticated attacker with high privileges can exploit this vulnerability remotely over the network. By crafting malicious input for the devices field during a firmware update action, the attacker achieves remote code execution on the underlying system, potentially compromising the host entirely.
CISA has published ICS Advisory ICSA-26-057-10 detailing the vulnerability, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10, along with a corresponding CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json. The vendor provides system software update information at https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate.
Details
- CWE(s)