CVE-2026-24663

Published Feb 27, 2026

Last updated 3 months ago

CVSS critical 9.0
web application

Overview

Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.
Source
ics-cert@hq.dhs.gov
NVD status
Analyzed
Products
xweb_500b_pro_firmware, xweb_300d_pro_firmware, xweb_500d_pro_firmware

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

ics-cert@hq.dhs.gov
CWE-78

Social media

Hype score
Not currently trending

Configurations