CVE-2026-25085
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - ics-cert@hq.dhs.gov
- Published
- 2026-02-27
- Last modified
- 2026-03-02
- Weaknesses
- CWE-394
Affected products
- Copeland Xweb 300d Pro (Copeland)
- Copeland Xweb 500b Pro (Copeland)
- Copeland Xweb 500d Pro (Copeland)
- Xweb 300d Pro Firmware (Copeland)
- Xweb 500b Pro Firmware (Copeland)
- Xweb 500d Pro Firmware (Copeland)
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
- https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
