Copeland xweb

Claroty Team82: 23 vulnerabilities in Copeland XWEB Pro supervisory refrigeration controllers chain to unauthenticated root RCE; a deterministic admin password derived from the device's own MAC address is one of THREE independent pre-auth paths

Claroty Team82 disclosed 23 vulnerabilities (21 rated high) in Copeland XWEB300D/500D/500B PRO supervisory refrigeration controllers (firmware ≤1.12.1), which manage field devices such as the XR60CX controller over Modbus RS-485 and Ethernet in commercial refrigeration and cold-chain deployments. Two named flaws chain to unauthenticated root RCE. CVE-2026-25085 is a logic flaw in the Lua user_authenticate handler: when an attacker supplies an unrecognized auth_mode value in the HTTP Authorization: Basic header, the function does not return nil/false but an unpopulated yet "truthy" table, "if an attacker supplied an unrecognized auth_mode, the user_authenticate function did not explicitly reject the request by returning nil or false. Instead, it returned an unpopulated table: { user = nil, role = nil, recovery = nil }" (Claroty Team82, 2026-08-09), and the router downstream checks only that something was returned, not its contents, so the malformed request slips through unauthenticated.

One of the three pre-auth paths is a deterministic admin-password generator: the credential is derived via a key-derivation function from a hardcoded firmware seed identical across the product line, plus the device's MAC address and the current date (both obtainable from unauthenticated public endpoints) letting an attacker reconstruct valid admin credentials fully offline with zero interaction with the target: "because the seed values are identical across the product line and the variables (MAC address and date) can be obtained via unauthenticated public endpoints, an adversary can reconstruct the entire derivation chain offline" (Claroty Team82, 2026-08-09). A third pre-auth path, CVE-2026-24663 (CVSS 9.0), is an unauthenticated OS command injection reachable by sending a crafted request to the libraries installation route, with no authentication step to bypass at all.

The 17 further CVEs (all listed above) are individually documented OS command-injection flaws across API/CGI endpoints (contacts import, firmware update, device templates, network/Wi-Fi configuration, the Modbus debug tool, and others), each requiring prior authentication and each scored CVSS 8.0. All are served by an embedded lighttpd instance where unsanitized user input reaches Lua system-execution calls running with elevated privileges, any of the three pre-auth primitives above chains directly to root: "since these services run with elevated privileges, successful exploitation results in immediate root-level code execution on the controller" (Claroty Team82, 2026-08-09). Claroty built a live physical demonstration: from an internet-exposed XWEB controller, an attacker reverse-engineers the connected field controller's undocumented Modbus register map and can set the temperature shown on the XR60CX display to any value while silently disabling cooling, spoiled food, or compromised temperature-sensitive medical supplies for pharmaceutical cold-chain. Copeland shipped firmware v1.13 through coordinated disclosure, fixing all 23 issues: "Copeland worked closely and collaboratively with us to develop a comprehensive remediation strategy. The vendor successfully patched these vulnerabilities and has uploaded firmware update version 1.13" (Claroty Team82, 2026-08-09); no source read reports exploitation of these flaws in the wild, but CERT-FR's alert of 2026-10-13 reports numerous compromises of Copeland xweb controllers without naming models, flaws or the entry vector (CERT-FR, 2026-10-13).

An anonymous, single-request path to full administrative control of internet-exposed cold-chain infrastructure demands action beyond a routine patch cycle, independent of confirmed exploitation: absence of exploitation is not evidence of safety when the exploit is a MAC address. Internet-exposed commercial refrigeration and cold-storage deployments are directly relevant to healthcare and food-safety cold-chain operations. Triage: the falsified display is itself the detection challenge: Claroty shows the temperature on the XR60CX field controller's display can be set to any value, so a normal reading on the display does not show that cooling is running; any authentication attempt using an auth_mode value the deployment does not use is a probe worth alerting on.

Builds on: CERT-FR adds Copeland and Dixell xweb to the hijacked refrigeration controllers; NCSC.ch rates…

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR and NCSC Switzerland say to remove internet exposure

Coopérative U, Intermarché and E. Leclerc confirmed to AFP a cyberattack on their refrigeration systems overnight on 11 to 12 October 2026; AFP reports from the retailers' statements at least 300 Intermarché or Netto shops and more than 100 Coopérative U outlets, and the Paris prosecutor opened an investigation (AFP, 2026-10-12). BFMTV puts the Intermarché and Netto count at 300, which it says is twice the first estimates of 150 points of sale, and Coopérative U below 100 stores, while Infosecurity quotes 150 Intermarché and 30 Netto stores (BFMTV, 2026-10-12; Infosecurity Magazine, 2026-10-12). BFMTV, writing in the conditional, reports that the attackers are said to have imposed a forced, continuous defrost with the setpoint at 50 degrees, on software older than version 4, heating the equipment for hours (translated from French) (BFMTV, 2026-10-12). CERT-FR's alert, in its revision of 2026-10-13, says it knows of numerous compromises of the remote refrigeration controllers Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb, and that exposing a management interface to the internet is contrary to good practice (CERT-FR, 2026-10-13). Danfoss told AFP that most affected units are legacy products that no longer receive software or security updates, naming the AK-SM800 and AK-SC355 regulators, and a person close to the Prime Minister said ANSSI had identified a vulnerability in software from a Danish company and that other countries may be affected (AFP, 2026-10-12). Intermarché told BleepingComputer that the attack reportedly affected a service provider that manages refrigeration systems in stores (BleepingComputer, 2026-10-12), and E. Leclerc told AFP that a cyberattack affected one of its refrigeration equipment suppliers (AFP, 2026-10-12). Infosecurity says the affected stores include those running vulnerable consoles with remote control and no adequately secured communication channel (Infosecurity Magazine, 2026-10-12). No source names an actor or the flaw or states how the attackers got in, and none confirms a tie to the 2025 AK-SM 8xxA vulnerabilities that Claroty found: BleepingComputer reports no tie (BleepingComputer, 2026-10-12) and NCSC Switzerland lists three of them only as alleged to be potentially related (NCSC Switzerland, 2026-10-13).

Triage: a defrost cycle is normal; BFMTV quotes sector professionals saying installations can be programmed for two hours of defrost per 24 hours, whereas the reported attack is said to be a continuous forced defrost at a 50-degree setpoint held for hours (translated from French) (BFMTV, 2026-10-12).

Builds on: A hidden authentication mechanism discloses internal network layout before an attacker even… · An attacker can reconstruct admin credentials for an exposed refrigeration controller offline…