CVE-2026-24663 is a critical (CVSS 9.0) unauthenticated OS command injection in Copeland XWEB Pro version 1.12.1 and earlier, in the libraries installation route. Copeland has provided a fix. Update XWEB Pro from Copeland's software update page or from the device's update menu.
What's affected
CISA advisory ICSA-26-057-10 lists the XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO at version 1.12.1 and earlier as affected. The same advisory covers more than twenty CVEs for these devices, including authentication bypass, path traversal and other flaws.
The record says an unauthenticated attacker can achieve remote code execution by sending a crafted request to the libraries installation route and injecting input into the request body. The attack complexity is high and the scope is changed.
How to check if you're exposed
Open the XWEB Pro management interface and check the software version under the system information. Anything at 1.12.1 or earlier needs the update.
Also check network exposure. Building and refrigeration controllers should not be reachable from the internet. Search your external address space for these devices if you are unsure.
What to do now
- Update XWEB Pro using Copeland's software update page for your model.
- Alternatively, from a device with internet access, use the SYSTEM menu, then Updates, then Network, as CISA's advisory describes.
- Make sure the device is not reachable from the internet, and place it behind a firewall or VPN.
- Segment building controls from your corporate network.
- Review CISA's advisory for the other CVEs fixed in the same update.
Why it matters
The weakness is CWE-78, OS command injection. The application builds an operating system command with input from a request and does not neutralize it, so request content can become part of the command. On a controller this means control of the device, and potentially of what it manages.
The record notes no authentication is needed. Operational technology often stays on old firmware for years, so this kind of fix is easy to miss. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Operational technology needs a patch path
Copeland XWEB Pro devices are web managed controllers used in commercial refrigeration and similar building systems. They are installed by facilities teams, run for years and are rarely seen by IT. That is exactly why advisories like this one stay unfixed.
CISA's advisory covers more than twenty CVEs for the same devices, including authentication bypass, path traversal and memory errors, and Copeland's fix covers the set. The command injection in this post is one piece of that bundle, so an update closes more than this CVE.
Find the devices
Ask facilities and operations teams where these controllers are installed, and which sites. Scan your own address space for web interfaces from these models, and check remote access arrangements with contractors who maintain them. Many are reachable through a vendor portal or a port forward that nobody documents.
Update safely
Copeland describes two update routes: the software update page for each model, or the device's own SYSTEM, Updates, Network menu when it has internet access. Plan the change with the site team, since controllers can affect temperature monitoring. Record the version before and after.
Contain what you cannot update today
Do not expose the interface to the internet. Put the controllers on their own network segment, allow access only from named management hosts or through a VPN, and log connections. Turn off remote access that nobody can justify.
Keep a register
For operational devices, keep a simple register of model, location, firmware version and owner. When the next CISA advisory lands, the register tells you in minutes whether you are affected.
Quick check
Is there a fix?
Yes. Copeland has provided a fix and CISA's advisory points to its software update page.
Does the fix cover other CVEs?
CISA's advisory lists many CVEs for these devices, and Copeland recommends updating to the latest version.
Sources
Last reviewed: 19 October 2026.
