What is the CVSS score of CVE-2026-24663?

CVE-2026-24663 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Xweb 500b Pro Firmware are affected by CVE-2026-24663?

A critical remote code execution vulnerability in XWEB Pro 1.12.1 and earlier allows unauthenticated attackers to gain complete system control through a single malicious request.

How to fix or mitigate CVE-2026-24663?

Within 24 hours: Identify all systems running XWEB Pro 1.12.1 or earlier and isolate them from production networks if possible; enable enhanced logging on affected systems. Within 7 days: Deploy WAF rules to block malicious requests to the libraries installation route; implement network segmentation to restrict access to XWEB Pro from trusted networks only. Within 30 days: Upgrade to a patched version if released; if no patch is available, evaluate alternative solutions or schedule controlled decommissioning of affected systems.

Xweb 500b Pro Firmware CVE-2026-24663

CRITICAL

OS Command Injection (CWE-78)

2026-02-27 ics-cert@hq.dhs.gov

Command Injection Xweb 500b Pro Firmware Xweb 300d Pro Firmware Xweb 500d Pro Firmware

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 01:16 nvd

CRITICAL 9.0

DescriptionCVE.org

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

AnalysisAI

Unauthenticated OS command injection in Copeland XWEB Pro HVAC controller version 1.12.1 and prior. EPSS 0.96% indicates real exploitation risk for internet-exposed building automation systems.

Technical ContextAI

CWE-78 OS command injection exploitable without authentication. Combined with CVE-2026-21718 auth bypass, provides full unauthenticated RCE on building automation controllers.