Home

Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed during system setup, leading to remote code execution.

PUBLISHED Reserved 2026-02-23 | Published 2026-02-27 | Updated 2026-02-27 | Assigner icscert




HIGH: 8.0CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-78

Product status

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Credits

Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA. finder

References

webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate

www.cisa.gov/news-events/ics-advisories/icsa-26-057-10

github.com/...p/csaf_files/OT/white/2026/icsa-26-057-10.json

cve.org (CVE-2026-3037)

nvd.nist.gov (CVE-2026-3037)

Download JSON