CVE-2026-25195

Published Feb 27, 2026

Last updated a month ago

Overview

Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route.
Source
ics-cert@hq.dhs.gov
NVD status
Analyzed
Products
xweb_300d_pro_firmware, xweb_500b_pro_firmware, xweb_500d_pro_firmware

Risk scores

CVSS 3.1

Type
Primary
Base score
6.6
Impact score
5.9
Exploitability score
0.7
Vector string
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity
MEDIUM

Weaknesses

ics-cert@hq.dhs.gov
CWE-78

Social media

Hype score
Not currently trending

Configurations