CVE-2026-25085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25085", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-05T19:05:16.849Z", "datePublished": "2026-02-27T00:33:06.657Z", "dateUpdated": "2026-03-02T18:58:50.355Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Copeland XWEB 300D PRO", "vendor": "Copeland", "versions": [{"lessThanOrEqual": "1.12.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Copeland XWEB 500D PRO", "vendor": "Copeland", "versions": [{"lessThanOrEqual": "1.12.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Copeland XWEB 500B PRO", "vendor": "Copeland", "versions": [{"lessThanOrEqual": "1.12.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in\n which an unexpected return value from the authentication routine is \nlater on processed as a legitimate value, resulting in an authentication\n bypass."}], "value": "A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in\n which an unexpected return value from the authentication routine is \nlater on processed as a legitimate value, resulting in an authentication\n bypass."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-394", "description": "CWE-394", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-27T00:33:06.657Z"}, "references": [{"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Copeland has provided a fix for the vulnerabilities and recommends users\n update the XWEB Pro to the latest version by going to their software \nupdate page \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\">https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate</a> in the \nsections dedicated to the different XWEBPRO models page.\n\n<br>"}], "value": "Copeland has provided a fix for the vulnerabilities and recommends users\n update the XWEB Pro to the latest version by going to their software \nupdate page \n https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the \nsections dedicated to the different XWEBPRO models page."}, {"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Alternatively, a user logged into an XWEB Pro with internet access can \nupdate XWEB Pro directly from Copeland servers via the menu SYSTEM -- \nUpdates | Network.\n\n<br>"}], "value": "Alternatively, a user logged into an XWEB Pro with internet access can \nupdate XWEB Pro directly from Copeland servers via the menu SYSTEM -- \nUpdates | Network."}], "source": {"advisory": "ICSA-26-057-10", "discovery": "EXTERNAL"}, "title": "Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T18:58:41.870013Z", "id": "CVE-2026-25085", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T18:58:50.355Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25085", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T18:58:41.870013Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T18:58:46.352Z"}}], "cna": {"title": "Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value", "source": {"advisory": "ICSA-26-057-10", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Copeland", "product": "Copeland XWEB 300D PRO", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.1"}], "defaultStatus": "unaffected"}, {"vendor": "Copeland", "product": "Copeland XWEB 500D PRO", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.1"}], "defaultStatus": "unaffected"}, {"vendor": "Copeland", "product": "Copeland XWEB 500B PRO", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Copeland has provided a fix for the vulnerabilities and recommends users\n update the XWEB Pro to the latest version by going to their software \nupdate page \n https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the \nsections dedicated to the different XWEBPRO models page.", "supportingMedia": [{"type": "text/html", "value": "Copeland has provided a fix for the vulnerabilities and recommends users\n update the XWEB Pro to the latest version by going to their software \nupdate page \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate\">https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate</a> in the \nsections dedicated to the different XWEBPRO models page.\n\n<br>", "base64": false}]}, {"lang": "en", "value": "Alternatively, a user logged into an XWEB Pro with internet access can \nupdate XWEB Pro directly from Copeland servers via the menu SYSTEM -- \nUpdates | Network.", "supportingMedia": [{"type": "text/html", "value": "Alternatively, a user logged into an XWEB Pro with internet access can \nupdate XWEB Pro directly from Copeland servers via the menu SYSTEM -- \nUpdates | Network.\n\n<br>", "base64": false}]}], "references": [{"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in\n which an unexpected return value from the authentication routine is \nlater on processed as a legitimate value, resulting in an authentication\n bypass.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in\n which an unexpected return value from the authentication routine is \nlater on processed as a legitimate value, resulting in an authentication\n bypass.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-394", "description": "CWE-394"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-27T00:33:06.657Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25085", "state": "PUBLISHED", "dateUpdated": "2026-03-02T18:58:50.355Z", "dateReserved": "2026-02-05T19:05:16.849Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-27T00:33:06.657Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Copeland XWEB 300D PRO", "vendor": "Copeland", "versions": [{"lessThanOrEqual": "1.12.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Copeland XWEB 500D PRO", "vendor": "Copeland", "versions": [{"lessThanOrEqual": "1.12.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Copeland XWEB 500B PRO", "vendor": "Copeland", "versions": [{"lessThanOrEqual": "1.12.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E13AD164-C82A-4D6C-84C0-83EB8B0A611C", "versionEndIncluding": "1.12.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "1707F67B-6365-4065-812C-7CC596C6CFF1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF93AA67-7ABF-45C8-8376-7A28F7D65464", "versionEndIncluding": "1.12.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "AEA10B9B-531A-4775-B32D-AC743D696126", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:copeland:xweb_500d_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "088F312E-06DF-4B90-A478-A6B5A39DE0F0", "versionEndIncluding": "1.12.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "A524988E-E22F-4B0F-AEE6-46B3F103989C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in\n which an unexpected return value from the authentication routine is \nlater on processed as a legitimate value, resulting in an authentication\n bypass."}, {"lang": "es", "value": "Existe una vulnerabilidad en Copeland XWEB Pro versi\u00f3n 1.12.1 y anteriores, en la que un valor de retorno inesperado de la rutina de autenticaci\u00f3n es posteriormente procesado como un valor leg\u00edtimo, resultando en un bypass de autenticaci\u00f3n."}], "id": "CVE-2026-25085", "lastModified": "2026-06-17T10:24:05.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25085", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T18:58:41.870013Z", "version": "2.0.3"}}]}, "published": "2026-02-27T01:16:19.367", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-394"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Copeland XWEB 300D PRO", "source": "cna", "vendor": "Copeland"}, "product": "copeland_xweb_300d_pro", "vendor": "copeland"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Copeland XWEB 500B PRO", "source": "cna", "vendor": "Copeland"}, "product": "copeland_xweb_500b_pro", "vendor": "copeland"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Copeland XWEB 500D PRO", "source": "cna", "vendor": "Copeland"}, "product": "copeland_xweb_500d_pro", "vendor": "copeland"}], "analysis": {"en": {"generated_at": "2026-04-16T15:45:14.019909+00:00", "value": {"mitigation_remediation": ["Apply the latest Copeland XWEB Pro firmware using the official software update page or by selecting SYSTEM\u202f\u2192\u202fUpdates\u202f\u2192\u202fNetwork on the device when internet access is available.", "If a firmware update cannot be performed immediately, restrict remote access to the device and limit authentication to trusted personnel until a patch is available.", "Review authentication logs for suspicious or repeated failed attempts and adjust device hardening settings accordingly."], "summary": {"action": "Patch Now", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The flaw affects Copeland XWEB Pro model 300D\u202fPRO, 500B\u202fPRO, and 500D\u202fPRO when running firmware 1.12.1 or earlier. These devices run Copeland hardware with the specified firmware, and users of any of the three mentioned models are vulnerable if they have not upgraded to a later firmware revision.", "description_and_impact": "A fault in Copeland XWEB Pro firmware versions 1.12.1 and earlier allows an authentication bypass. The logic incorrectly interprets an unexpected return value from the authentication routine as a valid credential, enabling an attacker to gain unauthorized system access. The weakness is captured by CWE\u2011394.", "risk_and_exploitability": "The CVSS score of 8.6 signifies a high\u2011severity vulnerability with potential for significant confidentiality and integrity compromise. EPSS indicates a very low exploitation likelihood (<1\u202f%), and the flaw is not yet listed in the CISA KEV catalog. Nevertheless, because the attack vector is network\u2011based authentication, an attacker with network visibility could potentially gain full control of the device. Monitoring network activity and applying the vendor\u2011issued patch are critical."}}}}, "created": "2026-02-27T09:03:12.605741+00:00", "updated": "2026-04-16T15:45:16.092749+00:00", "vendors": ["copeland", "copeland$PRODUCT$copeland_xweb_300d_pro", "copeland$PRODUCT$copeland_xweb_500b_pro", "copeland$PRODUCT$copeland_xweb_500d_pro"]}