CVEvulnerability

CVE-2026-25085

9.8 CRITICAL Published 2026-02-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-394

Description

A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.

Affected configurations

• copeland xweb 500b pro firmware (<= 1.12.1) • copeland xweb 300d pro firmware (<= 1.12.1) • copeland xweb 500d pro firmware (<= 1.12.1)

Related

Weakness · CWE (1)

  • CWE-394 Unexpected Status Code or Return Value weakness

References