2026-08-28 · view entry permalink →
Claroty Team82: 23 vulnerabilities in Copeland XWEB Pro supervisory refrigeration controllers chain to unauthenticated root RCE — a deterministic admin password derived from the device's own MAC address is one of THREE independent pre-auth paths
Claroty Team82 disclosed 23 vulnerabilities (21 rated high) in Copeland XWEB300D/500D/500B PRO supervisory refrigeration controllers (firmware ≤1.12.1), which manage field devices such as the XR60CX controller over Modbus RS-485 and Ethernet in commercial refrigeration and cold-chain deployments. Two named flaws chain to unauthenticated root RCE. CVE-2026-25085 is a logic flaw in the Lua user_authenticate handler: when an attacker supplies an unrecognized auth_mode value in the HTTP Authorization: Basic header, the function does not return nil/false but an unpopulated yet "truthy" table — "if an attacker supplied an unrecognized auth_mode, the user_authenticate function did not explicitly reject the request by returning nil or false. Instead, it returned an unpopulated table: { user = nil, role = nil, recovery = nil }" (Claroty Team82, 2026-08-09) — and the router downstream checks only that something was returned, not its contents, so the malformed request slips through unauthenticated.
CVE-2026-21718 is a deterministic admin-password generator: the credential is derived via a key-derivation function from a hardcoded firmware seed identical across the product line, plus the device's MAC address and the current date — both obtainable from unauthenticated public endpoints or local-network broadcast — letting an attacker reconstruct valid admin credentials fully offline with zero interaction with the target: "because the seed values are identical across the product line and the variables (MAC address and date) can be obtained via unauthenticated public endpoints, an adversary can reconstruct the entire derivation chain offline" (Claroty Team82, 2026-08-09). A third pre-auth path, CVE-2026-24663 (CVSS 9.0), is an unauthenticated OS command injection reachable by sending a crafted request to the libraries installation route, with no authentication step to bypass at all.
17 further CVEs — CVE-2026-20742, 20764, 20902, 20910, 21389, 23702, 24452, 24517, 24689, 24695, 25037, 25105, 25109, 25111, 25195, 25196 and 25721 — are individually documented OS command-injection flaws across API/CGI endpoints (contacts import, firmware update, device templates, network/Wi-Fi configuration, the Modbus debug tool, and others), each requiring prior authentication and each scored CVSS 8.0. All are served by an embedded lighttpd instance where unsanitized user input reaches Lua system-execution calls running with elevated privileges — any of the three pre-auth primitives above chains directly to root: "since these services run with elevated privileges, successful exploitation results in immediate root-level code execution on the controller" (Claroty Team82, 2026-08-09). Claroty built a live physical demonstration: from an internet-exposed XWEB controller, an attacker reverse-engineers the connected field controller's undocumented Modbus register map and can display a normal temperature on the supervisory UI while silently disabling cooling — spoiled food, or compromised temperature-sensitive medical supplies for pharmaceutical cold-chain. Copeland shipped firmware v1.13 through coordinated disclosure, fixing all 23 issues: "Copeland worked closely and collaboratively with us to develop a comprehensive remediation strategy. The vendor successfully patched these vulnerabilities and has uploaded firmware update version 1.13" (Claroty Team82, 2026-08-09); no exploitation in the wild is reported — this is coordinated vulnerability research, not an active campaign.
An anonymous, single-request path to full administrative control of internet-exposed cold-chain infrastructure is exactly the mechanics-forced timeline this pipeline treats as demanding action beyond a routine patch cycle, independent of confirmed exploitation: absence of exploitation is not evidence of safety when the exploit is a MAC address. Internet-exposed commercial refrigeration and cold-storage deployments sit directly under this constituency's healthcare and food-safety cold-chain infrastructure lens. Triage: the falsified-display behaviour is itself the detection challenge — since the supervisory UI can display normal readings while cooling is disabled, the durable signal is out-of-band: field-controller-level telemetry (direct Modbus reads from the XR60CX or equivalent, independent of the XWEB supervisory layer) that diverges from what the XWEB UI reports is the discriminator, and any authentication attempt using an auth_mode value the deployment does not use is a probe worth alerting on.
If an attacker supplied an unrecognized auth_mode, the user_authenticate function did not explicitly reject the request by returning nil or false. Instead, it returned an unpopulated table: { user = nil, role = nil, recovery = nil }.
Because the seed values are identical across the product line and the variables (MAC address and date) can be obtained via unauthenticated public endpoints, an adversary can reconstruct the entire derivation chain offline.
Since these services run with elevated privileges, successful exploitation results in immediate root-level code execution on the controller.
Copeland worked closely and collaboratively with us to develop a comprehensive remediation strategy. The vendor successfully patched these vulnerabilities and has uploaded firmware update version 1.13.