Copeland XWEB Pro 1.12.1 and prior, authenticated OS command injection via the MBird SMS service URL/code on the utility route (CVSS 8.0); fixed in firmware 1.13

Claroty Team82: 23 vulnerabilities in Copeland XWEB Pro supervisory refrigeration controllers chain to unauthenticated root RCE; a deterministic admin password derived from the device's own MAC address is one of THREE independent pre-auth paths

Claroty Team82 disclosed 23 vulnerabilities (21 rated high) in Copeland XWEB300D/500D/500B PRO supervisory refrigeration controllers (firmware ≤1.12.1), which manage field devices such as the XR60CX controller over Modbus on an RS-485 serial network in commercial refrigeration and cold-chain deployments. Two named flaws chain to unauthenticated root RCE. CVE-2026-25085 is a logic flaw in the Lua user_authenticate handler: when an attacker supplies an unrecognized auth_mode value in the HTTP Authorization: Basic header, the function does not return nil/false but an unpopulated yet "truthy" table, "if an attacker supplied an unrecognized auth_mode, the user_authenticate function did not explicitly reject the request by returning nil or false. Instead, it returned an unpopulated table: { user = nil, role = nil, recovery = nil }" (Claroty Team82, 2026-08-09), and the router downstream checks only that something was returned, not its contents, so the malformed request slips through unauthenticated.

One of the three pre-auth paths is a deterministic admin-password generator: the credential is derived via a key-derivation function from a hardcoded firmware seed identical across the product line, plus the device's MAC address and the current date, both obtainable via unauthenticated public endpoints, so once an attacker has those two values, valid admin credentials can be computed offline: "because the seed values are identical across the product line and the variables (MAC address and date) can be obtained via unauthenticated public endpoints, an adversary can reconstruct the entire derivation chain offline" (Claroty Team82, 2026-08-09). A third pre-auth path, CVE-2026-24663 (CVSS 9.0), is an unauthenticated OS command injection reachable by sending a crafted request to the libraries installation route, with no authentication step to bypass at all.

Eighteen further CVEs (all listed above) are OS command-injection flaws across API/CGI endpoints (contacts import, firmware update, device templates, network/Wi-Fi configuration, the Modbus debug tool, the SMS service settings and others), each requiring prior authentication and each scored CVSS 8.0; Claroty documents seventeen of them (Claroty Team82, 2026-08-09), and CISA's advisory adds CVE-2026-3037, injected through the MBird SMS service URL or code on the utility route (CISA, 2026-02-26). CISA also lists two low-severity flaws reachable without authentication: an arbitrary file read (CVE-2026-22877, CVSS 3.7) and a stack-based buffer overflow in an API route that terminates the program (CVE-2026-20797, CVSS 4.3) (CISA, 2026-02-26). All are served by an embedded lighttpd instance where unsanitized user input reaches Lua system-execution calls running with elevated privileges, any of the three pre-auth primitives above chains directly to root: "since these services run with elevated privileges, successful exploitation results in immediate root-level code execution on the controller" (Claroty Team82, 2026-08-09). Claroty built a live physical demonstration: from an internet-exposed XWEB controller, an attacker works out the connected field controller's Modbus register addresses, many of which are not publicly documented, from the XR60CX datasheet and protocol analysis, and can set the temperature shown on the XR60CX display to any value while silently disabling cooling, spoiled food, or compromised temperature-sensitive medical supplies for pharmaceutical cold-chain. Copeland shipped firmware v1.13 through coordinated disclosure, fixing all 23 issues: "Copeland worked closely and collaboratively with us to develop a comprehensive remediation strategy. The vendor successfully patched these vulnerabilities and has uploaded firmware update version 1.13" (Claroty Team82, 2026-08-09); no source read reports exploitation of these flaws in the wild, but CERT-FR's alert of 2026-10-13 reports numerous compromises of Copeland xweb controllers without naming models, flaws or the entry vector (CERT-FR, 2026-10-13).

An anonymous, single-request path to full administrative control of internet-exposed cold-chain infrastructure demands action beyond a routine patch cycle, independent of confirmed exploitation: absence of exploitation is not evidence of safety when the exploit is a MAC address. Internet-exposed commercial refrigeration and cold-storage deployments are directly relevant to healthcare and food-safety cold-chain operations. Triage: the falsified display is itself the detection challenge: Claroty shows the temperature on the XR60CX field controller's display can be set to any value, so a normal reading on the display does not show that cooling is running; any authentication attempt using an auth_mode value the deployment does not use is a probe worth alerting on.

Builds on: CERT-FR adds Copeland and Dixell xweb to the hijacked refrigeration controllers; NCSC.ch rates…