CVE-2026-25085
Copeland Xweb 500B Pro Firmware ≤ 1.12.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LSummary
CVE-2026-25085 is a high-severity Unexpected Status Code or Return Value (CWE-394) vulnerability in Copeland Xweb 500B Pro Firmware. Its CVSS base score is 8.6 (High).
Operationally, ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25085 is an authentication bypass vulnerability (CWE-394: Unexpected Return Value or Reference) in Copeland XWEB Pro version 1.12.1 and prior. The flaw occurs when an unexpected return value from the authentication routine is processed as a legitimate value, enabling attackers to circumvent authentication mechanisms without valid credentials.
The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), making it exploitable over the network by unauthenticated attackers with low attack complexity and no user interaction. Exploitation allows high-impact unauthorized access to confidential data, alongside low-impact modifications to integrity and availability.
CISA's ICS Advisory ICSA-26-057-10 and Copeland's system software update page provide mitigation details, including patch availability. Security practitioners should review these resources for update instructions and apply them promptly to affected systems.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8954
Vulnerability Data
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages will find missing or incorrect checks for unexpected but valid return values.
Requiring documented development standards and tools can mandate exhaustive checking of all function return values.
Engineering principles such as defensive programming and complete return-value checking stop the weakness from being introduced in code.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper validation of all function return values and status codes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing checks for unexpected but valid return values.
Secure development lifecycle requires handling of all return values and status codes.
Application security requirements include proper validation of function results and error conditions.
Secure coding standards directly mandate checking all legitimate return values and status codes.