Copeland vulnerabilities and threats

Copeland XWEB EVO versions 5.6.2 through 5.8.8 have an authentication bypass vulnerability that allows unauthenticated attackers to reset passwords of accounts flagged for reset at next login. This occurs due to missing session validation in the users.lua update_password action. Exploiting this flaw lets attackers gain immediate authenticated access by clearing the password expiration flag on newly onboarded operator accounts. The product line reached end of service in March 2026.

Copeland XWEB EVO versions 4.3.0 through 5.8.8 have an unauthenticated arbitrary file write vulnerability. Remote attackers can send crafted POST requests to config.lua with action=set to modify the system configuration file /etc/xwebconfig.json without any session validation. This allows tampering with configuration values or triggering a denial of service by causing a SYSTEM_NOT_CONFIGURED state. The product line reached end of service in March 2026.

XWEB EVO versions 5.6.2 through 5.8.8 contain an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions. The vulnerability arises because server_url and related credential fields are concatenated without escaping into a root-level curl command executed via io.popen. This allows attackers with authentication to inject arbitrary shell commands and execute them with root privileges. The product line reached its end of service in March 2026.

Copeland XWEB EVO versions 5.6.2 through 5.8.8 have a critical vulnerability involving hardcoded credentials. The Administrator web account uses a daily password mode that does not validate any stored secret, allowing attackers who can derive the MAC-based daily password to authenticate as Administrator and gain full admin access. This product line reached end of service in March 2026.

Copeland XWEB EVO versions 5.6.2 through 5.8.8 have an information disclosure vulnerability allowing unauthenticated attackers to access the device's eth0 MAC address and system clock via sysinfo.lua. This information can be used to derive the MAC-based daily password offline, enabling unauthorized authentication. The product line reached end of service in March 2026.

XWEB EVO versions prior to 5.6.2 contain a critical OS command injection vulnerability in the setuid-root CGI xwconsole.cgi. Unauthenticated remote attackers can exploit the unsanitized 'sh' parameter passed to popen() to execute arbitrary commands as root, leading to full system compromise. The product reached end of service in March 2026. A fixed version 5.6.2 is available.

XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability. Authenticated attackers can inject shell metacharacters into the output device path parameter processed by backup.lua, leading to arbitrary command execution as root. This occurs due to unescaped concatenation into shell commands executed via the wlua interpreter, including through setuid interfaces xwbackup.cgi and xwrestore.cgi. The product reached end of service in March 2026.

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026.

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.

XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026.

XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026.

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed during system setup, leading to remote code execution.

A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution.

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi-Fi SSID and/or password fields can lead to remote code execution when the configuration is processed.

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote code execution.