"It is worse than a weak daily code," wrote VulnCheck researcher Valentin Lobstein after examining the login logic of Dixell's XWEB EVO supervisory system.
VulnCheck discloses 14 high-severity flaws in Dixell / Copeland XWEB EVO
Cybersecurity firm VulnCheck published details on 14 vulnerabilities in Dixell refrigeration units that were discovered earlier this year. According to lab testing with rebuilt firmware, each flaw would have given an attacker administrative, or “root,” access to an infected unit. Many of the issues carry severity scores between 8.0 and 9.8, and VulnCheck reported that at least two of the vulnerabilities are known to be under active exploitation in the wild.
The vulnerabilities all affect Dixell and Copeland’s XWEB EVO supervision system. VulnCheck’s report followed Lobstein’s close inspection of the product’s access controls after he read about egregious lapses in another vendor’s device; he found that XWEB’s login page ran the submitted username as a shell command before it ever checked the password.
Copeland and Dixell: patches released, legacy systems still exposed
VulnCheck notified Copeland and Dixell and helped them fix the problems before disclosing the vulnerabilities; patches are now available. Copeland confirmed to CyberScoop that certain XWEB monitoring solutions are affected and urged customers to keep devices off the public internet and update to the latest patched software.
“We continue to recommend that customers follow industry-standard cybersecurity practices, including keeping devices off the public internet and maintaining software and firmware at the most current available levels,” a Copeland spokesperson wrote in response to a request for comment. The company said it has reached out to customers to reinforce cybersecurity best practices and patching guidance and that its teams are available to support them.
However, VulnCheck and others warned that legacy versions of the supervisory system remain exposed to potential takeover if not updated.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadXBOW honeypots show how fast internet-connected controllers attract probes
XBOW researcher Max Günther set up fake “honeypot” servers that mimicked the affected vendors and models to measure attacker interest. Günther deployed the servers online as part of a fabricated chain of pizza stores, indexed them on search engines such as Shodan, and created a dashboard visualizing potential real-world impacts.
Within a day, the honeypots were receiving hundreds of requests. “I’ve already seen hundreds of requests, everything from generic PHP2Shell-related exploit probes to actual attempts to log in to the simulated refrigeration controllers,” Günther wrote on LinkedIn. He also reported that “someone seemingly managed to log in and change the temperature of one of my virtual freezers, defrosting all the virtual pizzas inside.” The experiment underscored how quickly industrial controllers exposed to the internet can attract both automated and manual attempts to exploit vulnerabilities.
Links to an October mass incident and other suspected attacks
VulnCheck noted that XWEB EVO is one of four supervisory systems known to have been affected in an October hack that disrupted refrigeration controllers in 700 supermarkets across France. French authorities have blamed the Iranian government for the supermarket hacks, according to the reporting.
Separately, Reuters has reported that a similar series of incidents affecting refrigeration units owned by the U.S. military are suspected to be due to cyberattacks. The disclosure of high‑severity XWEB EVO flaws comes amid heightened scrutiny of internet-connected industrial controllers following those incidents.
What this means for technologists, procurement leaders, and military operators
- Technologists and security teams: Rapid exploitation observed in XBOW’s honeypots and the report that at least two XWEB EVO flaws are being actively exploited underscores the need to prioritize patching and to remove supervisory systems from public internet exposure where possible.
- Procurement and facility managers: The incident highlights the risk of legacy supervisory firmware remaining in service; procurement leaders must ensure vendors provide patching programs and clear guidance, and must enforce network segmentation and access controls.
- Military operators and large-scale operators: With Reuters reporting suspected cyberattacks against U.S. military refrigeration units and French authorities linking the October supermarket disruption to a nation-state actor, organizations that operate widely distributed refrigeration infrastructure should audit internet exposure and confirm they are running patched software.
VulnCheck’s coordinated disclosure and Copeland’s patches address the immediate, publicized flaws in XWEB EVO — but the episode reinforces a simple technical reality stated by both researchers: when industrial controllers sit on the public internet, they rarely stay unseen for long. Legacy installations that remain online, unpatched, and accessible continue to present straightforward opportunities for mischief or targeted disruption.
https://cyberscoop.com/copeland-dixell-refrigeration-vulnerabilities/
