What is the CVSS score of CVE-2026-24663?

CVE-2026-24663 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Xweb 300d Pro Firmware are affected by CVE-2026-24663?

A critical remote code execution vulnerability in XWEB Pro 1.12.1 and earlier allows unauthenticated attackers to gain complete system control through a single malicious request.

How to fix or mitigate CVE-2026-24663?

Within 24 hours: Identify all systems running XWEB Pro 1.12.1 or earlier and isolate them from production networks if possible; enable enhanced logging on affected systems. Within 7 days: Deploy WAF rules to block malicious requests to the libraries installation route; implement network segmentation to restrict access to XWEB Pro from trusted networks only. Within 30 days: Upgrade to a patched version if released; if no patch is available, evaluate alternative solutions or schedule controlled decommissioning of affected systems.

Xweb 300d Pro Firmware CVE-2026-24663

CRITICAL

OS Command Injection (CWE-78)

2026-02-27 ics-cert@hq.dhs.gov

Command Injection Xweb 300d Pro Firmware Xweb 500b Pro Firmware Xweb 500d Pro Firmware

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 01:16 nvd

CRITICAL 9.0

DescriptionCVE.org

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

AnalysisAI

Unauthenticated OS command injection in Copeland XWEB Pro HVAC controller version 1.12.1 and prior. EPSS 0.96% indicates real exploitation risk for internet-exposed building automation systems.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send crafted request to libraries installation route

Exploit

Inject OS command into request body

Execution

Execute arbitrary system commands

Impact

Achieve remote code execution

Access

Send crafted request to libraries installation route

Exploit

Inject OS command into request body

Execution

Execute arbitrary system commands

Impact

Achieve remote code execution

Vulnerability AssessmentAI

Exploitation	XWEB Pro version 1.12.1 or prior with libraries installation route exposed and accepting unauthenticated requests. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.0, EPSS 0.96%. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Attacker chains auth bypass with command injection to execute arbitrary commands on the XWEB Pro controller, potentially disrupting building climate control or using the device as a pivot point.
Remediation	Update firmware immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running XWEB Pro 1.12.1 or earlier and isolate them from production networks if possible; enable enhanced logging on affected systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.