CVE-2026-21718

The auth bypass flaw allows a network-accessible attacker (without any privileges or user interaction) to bypass the authentication layer embedded in the device firmware. After bypassing authorization, the attacker gains the ability to directly execute code on the system (pre-authenticated code execution). The vulnerability classified as CWE-327 indicates the use of obsolete or unsafe cryptographic algorithm as one of the vulnerability components.

An attacker can gain full control of the device, execute arbitrary code, modify configuration, or disrupt the operation of industrial control systems. In OT environments, this can lead to serious operational consequences, including failures of cooling or air conditioning installations operated by these controllers.

The firmware should be updated to a version higher than 1.12.1, according to the manufacturer's instructions available at: https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate. Until the patch is applied, it is recommended to isolate devices from public networks and restrict network access to authorized hosts only, in accordance with CISA advisory ICSA-26-057-10 recommendations.

Copeland XWEB Pro version 1.12.1 and earlier, including devices: Copeland Xweb 300D Pro, Copeland Xweb 500D Pro, and Copeland Xweb 500B Pro (firmware and hardware versions).