CVE-2026-20797 is a medium severity stack based buffer overflow (CVSS 4.3) in an API route of Copeland XWEB Pro 1.12.1 and earlier. An unauthenticated attacker on the adjacent network can crash the program. Copeland has provided a fix and recommends updating XWEB Pro to the latest version.
What's affected
CISA advisory ICSA-26-057-10 lists XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO at version 1.12.1 and earlier. The weaknesses are CWE-121 (stack based buffer overflow) and CWE-787 (out of bounds write). The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so an attacker must be on the same network segment.
The advisory covers many other XWEB Pro issues, with a combined score of 10.0, and its weakness types include authentication bypass, command injection and path traversal. This record only crashes the program. Because other flaws in the same advisory are more serious, treat the update as urgent even though this score is moderate.
The record does not mark the issue as exploited in the wild. CISA says it has no report of public exploitation targeting these vulnerabilities, and the issue is not in the CISA Known Exploited Vulnerabilities catalog. The advisory does not name a specific fixed version, only the latest one on the Copeland page.
How to check if you're exposed
Log in to the XWEB Pro web interface and read its software version. If it shows 1.12.1 or earlier, the device is affected. Then check how the device is reachable. XWEB units that can be reached from the internet are the first to fix.
On the network side, look for any rule that forwards traffic from outside to the XWEB web interface, and for the device appearing in internet scan results for your address ranges.
What to do now
- Update XWEB Pro to the latest version. Copeland offers a software update page with downloads per XWEB Pro model, and a device with internet access can update from the SYSTEM menu according to the advisory.
- Confirm the new version on the device after the update, and note it in your asset records.
- Take the device off the internet. Place it behind a firewall, separate from business networks.
- Use a VPN for remote access, and keep the VPN itself updated.
- Follow the other CISA recommended practices in the advisory and the ICS defense in depth guidance.
Why it matters
A stack buffer overflow happens when a program copies more data into a fixed size area on the stack than it can hold. The extra bytes overwrite neighbouring data. In the best case the program crashes, which is what the record scores here. In the worst case the overwritten data can steer the program, which is why the class is taken seriously in embedded devices.
CISA lists the affected sector as commercial facilities. A crash in a monitoring and control device can mean lost visibility into the equipment it watches, and an operator may not notice a problem elsewhere until it is late. Keeping such devices off the internet and patched removes most of the risk in this advisory.
Quick check
Why patch if the score is only 4.3?
Because the advisory bundles many flaws in the same product, some of them much more severe. The update fixes all of them together, and the exposure of the device is the same.
Sources
- CISA advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro
- Copeland XWEB software update page
- NVD record for CVE-2026-20797
Last reviewed: 19 October 2026.
