Copeland Dixell XWEB EVO: 14 critical flaws, 2+ exploited in October attack on refrigeration controllers in 700 French supermarkets
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 14/11/2026 00:03; os links antigos trazem para cá.
Fontes: cyberscoop.com ↗ darkreading.com ↗
Researchers have identified 14 critical vulnerabilities in the Copeland Dixell XWEB EVO refrigeration supervision system, with severity scores mostly between 8 and 9.8 (cyberscoop.com, 2026-11-13). Exploitation of at least two of them is confirmed in the wild and is linked to an October cyberattack that hit refrigeration controllers in about 700 supermarkets in France (cyberscoop.com). French authorities attributed that incident to the Iranian government (cyberscoop.com). An earlier Dark Reading piece (2026-11-06) covered supermarket freezer hacks across Europe and argued that one weakness in a product class can cascade through an industry and disrupt supply chains (darkreading.com). It named Copeland and Dixell XWEB controllers as affected but gave no CVEs, victim list, access method or actor. Patches have been released, but legacy unpatched devices remain at risk (cyberscoop.com).
Entenda a falha
A vulnerabilidade
VulnCheck published 14 flaws in the Copeland/Dixell XWEB EVO refrigeration supervision system. The articles give no CVE IDs. Many score between 8 and 9.8. In lab tests on rebuilt firmware, each flaw gave an attacker root or administrative access, which allows actions such as changing temperatures. One example is the login page, which runs the submitted username as a shell command before it checks the password. Patches exist, but the articles give no version numbers, and legacy versions stay exposed to takeover. At least two flaws are exploited in the wild, but the articles do not say which ones.
Como funciona
A request reaches the XWEB EVO web interface, typically from the internet when the device is exposed. On the login page, the submitted username is passed to a shell command before the password is checked. Input meant to be a name is therefore handled by the operating system's shell, and this happens before any authentication step. The articles do not describe the mechanism of the other 13 flaws.
Por que é vulnerável
For the login flaw, the cause is unsafe input handling: the username is run as a shell command, and this happens before the password check, so authentication does not protect that code path. The articles do not give the root cause of the other flaws or say what the patches change. Copeland advises keeping devices off the public internet, since exposure raises the risk.
Como foi descoberta
VulnCheck researcher Valentin Lobstein found the flaws earlier in 2026. He began looking at XWEB after reading about a device from another vendor with weak access controls, including an admin password set to the current day's date. VulnCheck notified Copeland and Dixell and helped them fix the problems before publishing details on Friday, November 13. Exploitation is also visible. XBOW researcher Max Günther ran honeypots mimicking these devices, and within a day attackers probed them, and one apparently logged in and changed a virtual freezer's temperature. XWEB EVO is one of four systems known to be affected in the October attack on refrigeration controllers in 700 French supermarkets, which French authorities blame on the Iranian government.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles say at least two flaws are exploited in the wild, so working exploits exist, but they do not say any was published. VulnCheck's own verification was done in lab tests on rebuilt firmware. Honeypots saw attackers probing and apparently logging in to change temperatures, so exploitation is real and patching should be treated as urgent, especially for internet-reachable devices.
Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 00:19.
Detalhes técnicos
- The flaws allow attackers to gain root or administrative access, enabling unauthorized control such as temperature manipulation (cyberscoop.com).
- Honeypots simulating these systems were rapidly targeted by attackers, which indicates active exploitation attempts (cyberscoop.com).
- No CVE identifiers, initial access method or IOCs appear in the available sources, and the two exploited flaws are not identified.
Remediação
- Apply the vendor updates promptly (cyberscoop.com).
- Keep these devices off public networks (cyberscoop.com).
- Legacy devices that cannot be patched stay exposed, so isolate them from the internet.
- Independent temperature monitoring and alarms are a sensible general safeguard. This is not stated by the sources.
Relatos divergentes
- Scope: Dark Reading describes freezer hacks "across Europe" (darkreading.com), while CyberScoop ties the October attack to roughly 700 supermarkets in France (cyberscoop.com). The sources do not say whether the European incidents and the French attack are the same campaign. Dark Reading itself does not say whether the incidents are linked.
- Attribution and detail: Dark Reading offered no attribution, CVE or victim count (darkreading.com). The later CyberScoop report (2026-11-13) supplies the Iranian-government attribution by French authorities, the vulnerability count and the confirmed exploitation. It is the more recent and more detailed source, though the attribution is relayed by a news outlet, not confirmed directly by the authorities.
Linha do tempo
-
Multiple critical vulnerabilities found in Copeland Dixell refrigeration XWEB EVO system exploited in supermarket hacks
ler a análise desta fonte ocultar
Security researchers have identified 14 critical vulnerabilities in the Copeland Dixell XWEB EVO refrigeration supervision system, with severity scores mostly between 8 and 9.8. Exploitation of at least two vulnerabilities is confirmed in the wild, linked to a cyberattack in October that impacted refrigeration controllers across 700 supermarkets in France. The flaws allow attackers root or administrative access, enabling unauthorized control such as temperature manipulation. The affected systems were part of an incident attributed by French authorities to the Iranian government. While patches have been released, legacy unpatched devices remain at risk. Experts advise keeping devices off public networks and applying updates promptly. Honeypots simulating these systems were rapidly targeted by attackers, highlighting active exploitation attempts.
-
darkreading.com ↗ · pub. 06/11/2026 11:00 · coletado 06/11 12:00 primeiro registro só resumo do feed
Supermarket freezer hacks across Europe show how one weakness can cascade through an industry and disrupt supply chains
ler a análise desta fonte ocultar
Dark Reading examines hacks of supermarket freezers in Europe and why they spread so far and so fast. Its central point is that a security issue in one class of product can cascade across an industry and disrupt supply chains at scale. The article snippet available does not give dates, a list of victims, the attack method, a CVE, or an attributed actor. It also does not say whether the incidents are linked.
Technical Details
- Copeland XWEB and Dixell XWEB controllers were reported as affected (tomshardware.com, via search summary).
- The available article text does not state the initial access method, any CVEs, the number of stores hit, or the losses.
Remediation
- The available sources give no specific fix. General practice for refrigeration and other OT controllers is to follow vendor guidance, limit network exposure, and keep independent temperature monitoring and alarms.