CVE-2026-22877
CRITICAL WAF: High
CVSS 9.1
Published: 2026-02-27
CWE-22
An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.
WAF Coverage Analysis
Path Traversal
High WAF Coverage
OWASP: A01:2021 Broken Access Control
930xxx - Local File Inclusion
Affected Software
| Vendor | Product | Version |
|---|---|---|
| copeland | xweb_300d_pro_firmware | up to 1.12.1 |
| copeland | xweb_500d_pro_firmware | up to 1.12.1 |
| copeland | xweb_500b_pro_firmware | up to 1.12.1 |
References
- github.com (Third Party Advisory)
- webapps.copeland.com (Product)
- www.cisa.gov (Third Party Advisory, US Government Resource)