Copeland XWEB Pro OS Command Injection Vulnerability Allowing Remote Code Execution
Vulnerability
A command injection vulnerability has been identified in Copeland XWEB Pro versions through 1.12.1. This vulnerability allows authenticated attackers to execute arbitrary code on the system by injecting malicious input into the request body sent to the contacts import route.
Impact
Exploitation of this vulnerability could lead to unauthorized command execution on the affected system.
Remediation
Users are advised to update XWEB Pro to the latest version. Instructions for updating are available on the Copeland System Software Updates page. Alternatively, users can update XWEB Pro directly from Copeland servers via the SYSTEM -- Updates | Network menu.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.