CVE-2026-21389
Published: 27 February 2026
Summary
CVE-2026-21389 is a high-severity OS Command Injection (CWE-78) vulnerability in Copeland Xweb 300D Pro Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by enforcing input validation and sanitization mechanisms at entry points like the contacts import route request body.
Mitigates the specific vulnerability through timely flaw remediation, such as applying vendor-provided software updates for XWEB Pro.
Complements input validation by restricting the types and characteristics of information accepted into the system, reducing opportunities for malicious command injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection vulnerability in a remotely accessible web application (contacts import route) directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary OS command execution (T1059).
NVD Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.
Deeper analysisAI
CVE-2026-21389 is an OS command injection vulnerability (CWE-78) in XWEB Pro version 1.12.1 and prior. Published on 2026-02-27, it affects the contacts import route, where an attacker can inject malicious input into the request body to achieve remote code execution on the system. The vulnerability carries a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
An authenticated attacker with high privileges (PR:H) can exploit this vulnerability remotely over the network (AV:N). Exploitation requires high attack complexity (AC:H) but no user interaction (UI:N), enabling a change in scope (S:C) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Successful attacks result in full remote code execution on the affected system.
CISA's ICS Advisory ICSA-26-057-10 addresses this vulnerability, with details available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 and in CSAF JSON format at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json. Copeland provides system software updates for mitigation at https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate.
Details
- CWE(s)