Copeland XWEB Pro OS Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in Copeland XWEB Pro versions through 1.12.1. This vulnerability allows authenticated attackers to execute arbitrary code on the system by injecting malicious input into the map filename field during the map upload process. The injected commands are executed on the server, leading to remote code execution.

Impact

Exploitation of this vulnerability allows for authentication bypass and arbitrary code execution on the affected system.

Remediation

Copeland has released a patch for this vulnerability. Users are advised to update XWEB Pro to the latest version available on the Copeland System Software Update page, or directly from Copeland servers via the XWEB Pro update menu.