Multiple critical vulnerabilities found in Copeland Dixell refrigeration XWEB EVO system exploited in supermarket hacks
Security researchers have identified 14 critical vulnerabilities in the Copeland Dixell XWEB EVO refrigeration supervision system, with severity scores mostly between 8 and 9.8. Exploitation of at least two vulnerabilities is confirmed in the wild, linked to a cyberattack in October that impacted refrigeration controllers across 700 supermarkets in France. The flaws allow attackers root or administrative access, enabling unauthorized control such as temperature manipulation. The affected systems were part of an incident attributed by French authorities to the Iranian government. While patches have been released, legacy unpatched devices remain at risk. Experts advise keeping devices off public networks and applying updates promptly. Honeypots simulating these systems were rapidly targeted by attackers, highlighting active exploitation attempts.
Entenda a falha
A vulnerabilidade
VulnCheck published 14 flaws, with no CVE IDs given in the articles, in the Copeland/Dixell XWEB EVO refrigeration supervision system. Many score between 8 and 9.8. In lab tests on rebuilt firmware, each one gave an attacker root or administrative access to the unit, which allows actions such as changing temperatures. One example is the login page, which runs the submitted username as a shell command before checking the password. Patches exist, but the articles give no version numbers. Legacy versions remain exposed. At least two flaws are exploited in the wild.
Como funciona
A request reaches the XWEB EVO web interface, typically from the internet when the device is exposed. On the login page, the submitted username is passed to a shell command before the password is checked. Input meant to be a name is therefore processed by the operating system's shell, and the flaw occurs before any authentication step. The articles do not describe the mechanism of the other 13 flaws.
Por que é vulnerável
For the login flaw, the cause is unsafe handling of input: the username is run as a shell command, and this happens before the password check, so authentication does not protect the code path. The articles do not give the root cause of the other flaws or what the patches change in detail. Exposing such controllers to the public internet increases the risk, as Copeland itself notes.
Como foi descoberta
VulnCheck researcher Valentin Lobstein found the flaws earlier in 2026. He began looking at XWEB after reading about a device from another vendor with weak access controls, including an admin password set to the current day's date. VulnCheck notified Copeland and Dixell and helped them fix the problems before publishing details on Friday, November 13. Exploitation is also visible: XBOW researcher Max Günther ran honeypots mimicking these devices, and within a day attackers probed them and one changed a virtual freezer's temperature. The XWEB EVO system is one of four affected in the October attack on refrigeration controllers in 700 French supermarkets, which French authorities blame on the Iranian government.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles say at least two of the flaws are exploited in the wild, so working exploits exist, but they do not say any was published. VulnCheck's own verification was done in lab tests on rebuilt firmware. Honeypots saw attackers log in and change temperatures, so exploitation is real and patching should be treated as urgent, especially for devices reachable from the internet.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 19:15.
Linha do tempo
-
Multiple critical vulnerabilities found in Copeland Dixell refrigeration XWEB EVO system exploited in supermarket hacks
ler a análise desta fonte ocultar
Security researchers have identified 14 critical vulnerabilities in the Copeland Dixell XWEB EVO refrigeration supervision system, with severity scores mostly between 8 and 9.8. Exploitation of at least two vulnerabilities is confirmed in the wild, linked to a cyberattack in October that impacted refrigeration controllers across 700 supermarkets in France. The flaws allow attackers root or administrative access, enabling unauthorized control such as temperature manipulation. The affected systems were part of an incident attributed by French authorities to the Iranian government. While patches have been released, legacy unpatched devices remain at risk. Experts advise keeping devices off public networks and applying updates promptly. Honeypots simulating these systems were rapidly targeted by attackers, highlighting active exploitation attempts.