PT-2026-22279 · Xweb Pro · Xweb Pro

Amir Zaltzman + 1 · Publicado 2026-02-27 · Atualizado 2026-03-04 · CVE-2026-3037

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions 1.12.1 and earlier

Description A flaw exists that allows a logged-in attacker to execute code on a system remotely. This is achieved by altering harmful input within the URL of the MBird SMS service and/or code through the utility path. This input is then processed during system configuration, resulting in remote code execution. The vulnerability is an OS command injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-3037

Produtos afetados

Xweb Pro

Referências · 10

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json · Nota
• https://twitter.com/CVEnew/status/2027380215152890332 · Publicação no Twitter
• https://twitter.com/cracbot/status/2029149985565229572 · Publicação no Twitter
• https://t.me/CVEtracker/45921 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2027310886872842557 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3037 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3037 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-26-057-10 · Nota
• https://twitter.com/cracbot/status/2028787783582830885 · Publicação no Twitter
• https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate · Nota