CVE-2026-22877 is an arbitrary file read flaw in Copeland XWEB Pro controllers, version 1.12.1 and earlier. Unauthenticated attackers can read files on the system and possibly cause denial of service. The CVSS score is 3.7, but CISA lists it among a larger set of XWEB issues, so apply the vendor update.
What's affected
The record covers XWEB 300D Pro, 500B Pro and 500D Pro, hardware and firmware, at version 1.12.1 and earlier.
CISA advisory ICSA-26-057-10 groups this CVE with many others in the same product family, covering authentication bypass, command injection and buffer overflow. Reading about this one alone understates the update need.
How to check if you're exposed
Open the XWEB Pro web interface and read the installed software version. If it is 1.12.1 or older, you are in range.
Also check where the device is reachable. A building controller that answers on a public address is a bigger problem than the file read score suggests. Look at firewall rules and any port forwards that point at it.
What to do now
- Update to the latest XWEB Pro version from the Copeland software update page for your model.
- Alternatively, if the device has internet access, update from the device menu path SYSTEM, then Updates, then Network, as CISA describes.
- Remove direct internet exposure and place the device behind a firewall or VPN.
- Follow the other CVEs in the CISA advisory, since the same update addresses them.
Why it matters
The weakness is CWE-22 (Path Traversal), meaning the application accepts a path and lets it point outside the folder it should serve. The result is that files outside the intended area can be read without logging in.
The CVSS score is low because the vector rates the direct impact as limited loss of confidentiality. Scores describe one bug in isolation. In practice an exposed controller with several flaws is judged by the worst of them. The record does not mark this CVE as a Known Exploited Vulnerability.
Quick check
Why is the score only 3.7?
The vector rates a high complexity attack with limited confidentiality impact. The wider advisory lists more serious issues in the same product.
Is there a fixed version number?
The advisories we read point to the latest release on the Copeland update page rather than naming one number, so check that page for your model.
Sources
Last reviewed: 19 October 2026.
