Dixell/Copeland XWEB EVO refrigeration supervisors: VulnCheck published 14 CVEs on 2026-11-12, seven scored CVSS 4.0 9.2 to 9.3 (unauthenticated command injection that runs as root, a hard-coded Administrator password, Administrator and root passwords computed from the MAC address and date); Copeland ended support on 2026-03-16 and ships no fixes; no exploitation reported
XWEB EVO refrigeration controllers: 14 CVEs, unauthenticated root RCE and a hard-coded password, no fix will ship
Analysis
VulnCheck, the assigning CNA, describes unauthenticated command injection in XWEB EVO through the password field (VulnCheck, 2026-11-12) and the username field (VulnCheck, 2026-11-12) of its login and API scripts, and through the sh parameter of the setuid xwconsole.cgi (VulnCheck, 2026-11-12), all reaching root; a hard-coded password for the built-in Administrator account that gives a full session in one request (VulnCheck, 2026-11-12); and Administrator and root passwords that can be computed offline from the device MAC address and the date (VulnCheck, 2026-11-12; VulnCheck, 2026-11-12; VulnCheck, 2026-11-12). The cluster holds 14 records, and the seven scored 9.2 or higher are the ones covered here (ENISA EUVD, 2026-11-12). The records' ranges end before 5.6.2 or 5.7.0 or run through 5.8.8, but Copeland's download pages list EVO packages only up to 5.2.3 of 2018 (Copeland, 2026-11-13), and its bulletin says software support ended on 2026-03-16 with no further firmware or security updates (Copeland, 2026-03-16), so no source shows where a fixed build can be had.
No source reports exploitation or a public proof of concept for these CVEs, and none ties them to the compromises of Danfoss, Copeland and Dixell controllers. Copeland's bulletin of 2026-10-14, carried in the Dixell France guide that CERT-FR links, acknowledges a vulnerability on an end-of-life generation of XWEB EVO controllers and tells operators to remove all XWEB EVO units from the public internet immediately (translated from French) (Dixell France, 2026-10-14); NCSC Switzerland says that guidance addresses end-of-service XWEB EVO systems and that the public information does not confirm exploitation of the Danfoss CVEs it lists (NCSC Switzerland, 2026-11-06), and BACS lists Copeland and Dixell XWEB as potentially affected (BACS, 2026-11-10). The one compromised-unit log read concerns an XWEB Pro, not an EVO (Ransom-ISAC, 2026-11-06).
Cited evidence
End of software support for the XWEB EVO family
in a single request to obtain a complete admin session and full control over the application.
Sources15
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.