Researchers Find 14 Critical Vulnerabilities in Copeland/Dixell Refrigeration Systems

VulnCheck disclosed 14 vulnerabilities affecting the XWEB EVO supervision system used with Dixell refrigeration units, manufactured by Copeland. The flaws were discovered earlier in the year, and the researchers tested rebuilt versions of the vendor’s firmware. According to the source, every vulnerability could have enabled an attacker to obtain root or administrative access to an affected unit. Many of the flaws have severity scores ranging from 8 to 9.8, while at least two are reportedly being actively exploited in the wild. These findings make the issue relevant beyond commercial refrigeration: connected control systems may also be present in government buildings and facilities supported by federal contractors.

The disclosure comes as operators in the United States and Europe respond to recent hacking incidents involving refrigeration equipment. The XWEB EVO system was among four supervision systems known to have been affected in an October attack on refrigeration controllers at 700 supermarkets across France. VulnCheck researcher Valentin Lobstein said he began examining XWEB after reading about security lapses in another affected device, then focused on the system’s access controls. The source quotes Lobstein describing a particularly serious issue: “The login page runs the submitted username as a shell command before it ever checks the password.” That behavior illustrates why industrial control security reviews must include authentication flows and management interfaces, not simply perimeter defenses.

VulnCheck and the researchers notified Copeland and Dixell and helped address the reported problems before public disclosure. Patches are available, but legacy versions remain exposed to potential takeover. Copeland confirmed that certain XWEB monitoring solutions are affected and urged customers to keep devices off the public internet and update to the latest patched software and firmware. For government facility managers and contractors, the immediate procurement and operational implication is to confirm whether supported sites use affected systems, establish version and exposure status, and coordinate remediation with equipment owners and service providers. The source identifies no solicitation, contract award, or specific procurement event; the signal is operational cybersecurity intelligence that may influence maintenance, modernization, and facility-risk planning.

Internet exposure can draw attention quickly. XBOW researcher Max Günther set up honeypot servers mimicking affected vendors and models, presenting them online as a fictional chain of pizza stores and indexing them with services such as Shodan. He reported receiving substantial activity: “I’ve already seen hundreds of requests, everything from generic PHP2Shell-related exploit probes to actual attempts to log in to the simulated refrigeration controllers.” This observation reinforces the need to treat connected refrigeration supervision as operational technology, with controlled remote access, current patching, and documented ownership. Contractors maintaining government facilities should include refrigeration controls in asset inventories and security coordination, particularly where legacy installations or internet-facing management interfaces may remain in service.

• VulnCheck disclosed 14 vulnerabilities in Copeland/Dixell XWEB EVO refrigeration supervision systems.
• Lab testing found that each flaw could enable root or administrative access to an affected unit.
• Many vulnerabilities have reported severity scores between 8 and 9.8; at least two are reportedly actively exploited.
• Patches are available, but legacy versions remain exposed to potential takeover.
• Copeland recommends keeping affected devices off the public internet and maintaining current software and firmware.
• Facility operators should inventory XWEB EVO deployments, determine software versions, check external exposure, and prioritize patching.
• Government facility contractors should account for connected refrigeration and other industrial-control systems in maintenance and cybersecurity work.
• XBOW honeypots attracted hundreds of requests, including exploit probes and attempted logins, illustrating the attention internet-connected controllers can receive.
• The source identifies no specific solicitation, contract, award, or procurement event; follow-on activity may involve routine maintenance, upgrades, or security remediation.