Skip to main content

Xweb 300d Pro Firmware CVE-2026-21718

CRITICAL
Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
2026-02-27 ics-cert@hq.dhs.gov
Authentication Bypass Xweb 300d Pro Firmware Xweb 500b Pro Firmware Xweb 500d Pro Firmware Copeland
10.0
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send unauthenticated network request
  2. Exploit
    Bypass authentication mechanism
  3. Execution
    Execute arbitrary code pre-authentication
  4. Impact
    Achieve system compromise

Vulnerability Assessment

Weakness
CWE
CWE-327
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Approved algorithm selection
Exploitation Conditions

No special conditions — remote unauthenticated exploitation against Copeland XWEB Pro version 1.12.1 and prior with default configurations.
Impact

CVSS 10.0. ICS/OT vulnerability affecting building automation. Unauthenticated access to HVAC controllers can impact physical safety.
Exploit ScenarioDerived

Attacker discovers internet-exposed XWEB Pro controller, bypasses authentication using cryptographic weakness, gains full control of HVAC systems — can modify temperature setpoints, disable alarms, or cause equipment damage.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Authentication bypass in Copeland XWEB Pro HVAC controller version 1.12.1 and prior due to weak cryptographic algorithm. CVSS 10.0 — any unauthenticated attacker can gain full system access to building automation controllers.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 10.0

Authentication bypass via broken cryptography in Copeland XWEB Pro HVAC controller.

RemediationAI

Update XWEB Pro firmware. Never expose building automation controllers to the internet. Implement network segmentation for OT systems.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-327 weak cryptographic algorithm allows complete authentication bypass in XWEB Pro v1.12.1 and prior. Building automation controller used in commercial HVAC systems.

Know when Xweb 300d Pro Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.

Executive ViewAI

Why It Matters

A critical authentication bypass vulnerability (CVE-2026-21718, CVSS 10.0) affects Copeland XWEB Pro v1.12.1 and earlier, allowing unauthenticated attackers to execute arbitrary code on affected systems. Any organization running this software faces immediate risk of system compromise, data theft, and operational disruption without a vendor patch currently available.

Business Impact: Severe
Compensating Controls

Implement network segmentation to isolate affected Copeland XWEB Pro systems from critical infrastructure. Deploy Web Application Firewall (WAF) rules to monitor and block suspicious requests attempting authentication bypass or code execution payloads. Enable verbose audit logging on all access attempts. Restrict administrative access to the application to specific IP addresses or VPNs only. Consider disabling remote access features if operationally feasible. Establish continuous vulnerability scanning. No vendor patch currently available; monitor Copeland security advisories daily for patch release.

Threat Intelligence Overview

EPSS Score
0.0%
Top 89% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +50
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*

More in Xweb 300d Pro Firmware

View all
CVE-2026-24663 CRITICAL
9.0 Feb 27

Unauthenticated OS command injection in Copeland XWEB Pro HVAC controller version 1.12.1 and prior. EPSS 0.96% indicates
CVE-2026-25085 HIGH
8.6 Feb 27

Copeland XWEB Pro firmware versions 1.12.1 and earlier suffer from an authentication bypass vulnerability where malforme
CVE-2026-24517 HIGH
8.0 Feb 27

Remote code execution in Xweb 300d/500b/500d Pro firmware versions 1.12.1 and earlier allows authenticated attackers to

CVE-2026-25195 HIGH
8.0 Feb 27

Remote code execution in XWEB Pro firmware versions 1.12.1 and earlier allows authenticated attackers to execute arbitra
CVE-2026-25111 HIGH
8.0 Feb 27

Remote code execution in XWEB Pro versions 1.12.1 and earlier allows authenticated attackers to execute arbitrary OS com
CVE-2026-25109 HIGH
8.0 Feb 27

Remote code execution in Xweb 300d Pro, 500d Pro, and 500b Pro firmware versions 1.12.1 and earlier allows authenticated
CVE-2026-24695 HIGH
8.0 Feb 27

Remote code execution in XWEB Pro firmware versions 1.12.1 and earlier allows authenticated attackers to execute arbitra
CVE-2026-24689 HIGH
8.0 Feb 27

Remote code execution in XWEB Pro firmware (versions 1.12.1 and earlier) allows authenticated attackers to execute arbit
CVE-2026-21389 HIGH
8.0 Feb 27

Remote code execution in XWEB Pro firmware (versions 1.12.1 and earlier) allows authenticated attackers to execute arbit
CVE-2026-20910 HIGH
8.0 Feb 27

Remote code execution in XWEB Pro firmware versions 1.12.1 and earlier allows authenticated attackers to execute arbitra
CVE-2026-20902 HIGH
8.0 Feb 27

Remote code execution in Xweb 300d Pro, 500b Pro, and 500d Pro firmware (version 1.12.1 and prior) allows authenticated

CVE-2026-20742 HIGH
8.0 Feb 27

Remote code execution in XWEB Pro firmware versions 1.12.1 and earlier allows authenticated attackers to execute arbitra

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

View all
CVE-2022-3365 CRITICAL POC
9.8
CVE-2014-8687 CRITICAL POC
9.8
CVE-2017-17382 MEDIUM POC
5.9
CVE-2016-6602 CRITICAL POC
9.8
CVE-2023-34039 CRITICAL POC
9.8
CVE-2025-2539 HIGH POC
7.5
CVE-2017-9466 CRITICAL POC
9.8
CVE-2023-5347 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
REF https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json REF https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate REF https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy