PT-2026-22262

CVE-2026-25195

Published

2026-02-27

Updated

2026-03-09

Description by

CVSS 3.1

8.0

High

MetricsAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions 1.12.1 and earlier

Description An operating system command injection issue exists in XWEB Pro. A successful exploit allows an authenticated attacker to execute code remotely on the system by providing a manipulated firmware update file through the firmware update path. The vulnerable component is the firmware update route. The vulnerable parameter is the firmware update file.

Recommendations Versions prior to 1.12.1 should be updated.

Exploitability

Fix

Impacts

Researchers

Amir Zaltzman

Noam Moshe

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers