Recent research has uncovered 23 vulnerabilities in Copeland’s XWEB Pro supervisory controllers, devices integral to managing commercial refrigeration systems in environments such as supermarkets, warehouses, and hospitals. Notably, 21 of these vulnerabilities are classified as high severity, enabling unauthenticated attackers to gain full root-level control over the devices via network access.
Commercial refrigeration systems typically employ a hierarchical structure. At the top, a supervisory controller interfaces with the internet, while field controllers manage individual components like compressors and fans through serial connections. The Copeland XWEB300D and XWEB500D PRO controllers are pivotal in this setup, overseeing temperature logs essential for food safety and regulatory compliance.
Authentication Bypass and Password Generation Flaws
One significant flaw, identified as CVE-2026-25085, arises from a coding logic error. When an unrecognized login type is submitted, the system should reject it. Instead, it returns an empty data structure that the software misinterprets as valid, allowing attackers to bypass authentication checks and access administrative functions without credentials.
Another critical vulnerability, CVE-2026-21718, involves the device’s method of generating administrator SSH and web passwords. These passwords are derived from the current date, the device’s MAC address, and secret keys embedded in the firmware. Since the date is public and the MAC address is easily obtainable, attackers can calculate the exact daily password offline, granting them administrative access.
Command Injection Vulnerabilities
Beyond authentication issues, researchers identified 19 command injection flaws across various device functions, including firmware updates and network settings. These vulnerabilities allow attackers to insert hidden system commands into normal-looking data, providing complete root access to the controller.
To demonstrate the real-world impact, researchers constructed a mini-refrigerator connected to an XWEB controller and an XR60CX field unit. Using a custom Python tool, they manipulated the display to show arbitrary temperatures between -50 and 110 degrees Celsius. More alarmingly, they executed an attack where the display continued to show the correct temperature while the cooling fans were silently deactivated. Consequently, the refrigerator warmed, spoiling its contents without any visible warning on the display.
Copeland has addressed these issues by releasing firmware version 1.13, which patches all 23 vulnerabilities. Facilities utilizing XWEB Pro controllers are urged to update immediately, as exploitation requires no valid credentials and can be conducted remotely over the internet.
This research underscores a growing risk in operational technology: software vulnerabilities in industrial controllers can directly cause physical damage, from spoiled groceries to compromised medical supplies. Experts recommend removing these controllers from direct internet exposure, segmenting refrigeration networks from other systems, and promptly applying vendor patches to prevent similar silent sabotage attacks.
As the integration of operational technology with internet-connected systems continues to expand, the importance of robust cybersecurity measures becomes increasingly critical. Organizations must proactively address vulnerabilities to safeguard both digital and physical assets.
