CVE-2026-25721

Published Feb 27, 2026

Last updated 3 months ago

Overview

Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore action in the API V1 route.
Source
ics-cert@hq.dhs.gov
NVD status
Analyzed
Products
xweb_300d_pro_firmware, xweb_500d_pro_firmware, xweb_500b_pro_firmware

Risk scores

CVSS 3.1

Type
Primary
Base score
8.8
Impact score
5.9
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

ics-cert@hq.dhs.gov
CWE-78

Social media

Hype score
Not currently trending

Configurations