CVE-2026-25085: Copeland XWEB Pro Authentication Bypass via Unexpected Return Value
CVE-2026-25085 affects Copeland XWEB Pro version 1.12.1 and earlier, where an unexpected return value from the authentication routine is later processed as a legitimate result. The flaw can lead to an authentication bypass, and NVD scores it 9.8 (critical). CISA KEV does not list it, and the sources consulted show no confirmed active exploitation.
Overview
CVE-2026-25085 is reported by CISA in advisory ICSA-26-057-10 for Copeland XWEB and XWEB Pro products. The record describes XWEB Pro version 1.12.1 and earlier. The authentication routine can return a value that is not a standard success or failure status, and later code treats that value as valid. The record classifies the weakness as CWE-394 (unexpected status code or return value).
Impact
- The record describes an authentication bypass as the result of the flaw.
- NVD assigns a CVSS base score of 9.8 and a vector with network attack vector, low complexity, no privileges required and no user interaction required.
- ICS-CERT entries in the record list a score of 8.6.
- Confidentiality, integrity and availability impacts are rated high in the NVD vector.
Affected products and versions
- The record lists XWEB 300D PRO, XWEB 500B PRO and XWEB 500D PRO, along with their firmware entries, with versions 1.12.1 and earlier.
- The description names XWEB Pro version 1.12.1 and prior as the affected range.
- No version beyond 1.12.1 is listed as affected in the record.
Exploitation status
- The record marks this CVE as not listed in CISA KEV.
- No confirmed active exploitation appears in the sources consulted.
- The SSVC exploitation field is set to none, and the automatable field is set to yes.
- The EPSS probability is 0.0051 with a percentile of 0.42634, as recorded.
Remediation and mitigation
- The record does not list a fixed version. The vendor update page referenced by the record is the first place to check for available software updates for affected models.
- Operators should confirm the firmware version on each device against the affected range and apply vendor guidance where an update is available.
- Until a fix is verified, reduce exposure by restricting network access to management and authentication interfaces, placing devices behind segmented networks, and limiting which hosts can reach them.
- Review authentication logs and access control settings after any change to reduce the chance of unnoticed unauthorized access.
Detection guidance
- Monitor authentication events on these devices for successful logins that do not match known users or expected sources.
- Alert on logins from unexpected network segments and on configuration changes that follow an unexplained login.
- Compare device firmware versions against inventory records to find units still in the affected range.
Limitations of the available information
- The record does not state a fixed version, a patch date or vendor-confirmed remediation steps beyond the referenced update page.
- The record does not describe the exact conditions under which the unexpected return value occurs.
- Whether models or firmware variants outside the listed entries are affected is unknown.
- The EPSS date in the record is later than the publication date, so the EPSS values should be treated with care.
Frequently asked questions
Which Copeland products are affected by CVE-2026-25085?
The record lists XWEB 300D PRO, XWEB 500B PRO and XWEB 500D PRO, along with their firmware entries, for versions 1.12.1 and earlier.
Is there a fixed version for this vulnerability?
The record does not list a fixed version. The vendor update page referenced in the record should be checked for available updates.
Is this vulnerability being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.