CVE-2026-20797

A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.

Score

CVSS 3.1 9.8 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2026-02-27

Last modified

2026-05-10

Weaknesses

CWE-121, CWE-787

Affected products

• Copeland Xweb 300d Pro (Copeland)
• Copeland Xweb 500b Pro (Copeland)
• Copeland Xweb 500d Pro (Copeland)
• Xweb 300d Pro Firmware (Copeland)
• Xweb 500b Pro Firmware (Copeland)
• Xweb 500d Pro Firmware (Copeland)

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
• https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10