Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in
which an unexpected return value from the authentication routine is
later on processed as a legitimate value, resulting in an authentication
bypass.
Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in
which an unexpected return value from the authentication routine is
later on processed as a legitimate value, resulting in an authentication
bypass.
Copeland has provided a fix for the vulnerabilities and recommends users
update the XWEB Pro to the latest version by going to their software
update page
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the
sections dedicated to the different XWEBPRO models page.
Alternatively, a user logged into an XWEB Pro with internet access can
update XWEB Pro directly from Copeland servers via the menu SYSTEM --
Updates | Network.
Configurations
Workarounds
Exploits
Credits
finder
Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in
which an unexpected return value from the authentication routine is
later on processed as a legitimate value, resulting in an authentication
bypass.