CVE-2026-24517

{"id": "CVE-2026-24517", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "published": "2026-02-27T01:16:18.597", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json", "source": "[email protected]"}, {"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate", "source": "[email protected]"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection \n\n\nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n injecting malicious input into requests sent to the firmware update \nroute."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo existe en XWEB Pro versi\u00f3n 1.12.1 y anteriores, lo que permite a un atacante autenticado lograr la ejecuci\u00f3n remota de c\u00f3digo en el sistema mediante la inyecci\u00f3n de entrada maliciosa en las solicitudes enviadas a la ruta de actualizaci\u00f3n del firmware."}], "lastModified": "2026-02-27T14:06:37.987", "sourceIdentifier": "[email protected]"}