Security researchers have discovered 23 vulnerabilities in Copeland’s XWEB Pro commercial refrigeration controllers, with 21 rated as high severity.
These vulnerabilities could allow unauthenticated attackers to gain root-level remote code execution and control connected cooling equipment.
Claroty’s Team82 found that an attacker could exploit a combination of authentication flaws, predictable administrator credentials, and command-injection vulnerabilities to compromise the XWEB Pro supervisory controllers.
In a proof-of-concept environment, researchers demonstrated that a compromised controller could turn off refrigeration components while still displaying normal temperature readings. This could create conditions that silently spoil food, pharmaceuticals, or other temperature-sensitive goods.
Copeland XWEB Pro Vulnerabilities
Copeland has addressed these flaws in firmware version 1.13, according to Team82. Supervisory controllers are crucial within commercial refrigeration networks.
XWEB Pro devices connect to Ethernet networks, allowing operators to monitor alarms, review temperature logs, and configure refrigeration settings for multiple units remotely.
These controllers communicate with field devices via RS485 serial networks, often using the Modbus protocol. These field controllers directly manage equipment, including compressors, cooling fans, defrost heaters, lighting, and temperature sensors.
This architecture makes the XWEB300D Pro and XWEB500D Pro particularly vulnerable. If the supervisory layer is compromised, an attacker could gain centralized visibility and control over a wide range of physical refrigeration assets.
Authentication Bypass and Predictable Passwords
One of the most serious issues, tracked as CVE-2026-25085, is a logic flaw in the Lua-based authentication middleware used by the Lighttpd web server in the platform.
This flaw arises because the application parses the HTTP Basic Authorization header and expects a recognized authentication mode, such as local accounts or LDAP.
However, if an unrecognized mode is provided, the authentication function returns an empty Lua table rather than explicitly rejecting the request.
Since Lua treats tables as truthy values, even empty ones, the routing logic mistakenly accepts this result as valid authentication. Consequently, a remote attacker could access protected administrative API routes without legitimate credentials.
Team82 also identified CVE-2026-21718, a deterministic password-generation mechanism affecting both administrator SSH and web interface credentials.
The system generates passwords based on the current date, the controller’s MAC address, and hard-coded cryptographic material embedded in the firmware.
An attacker can obtain the MAC address and date from publicly accessible endpoints. At the same time, the static seed values are consistent across the product line.
Therefore, someone able to replicate the password derivation process could generate valid daily administrator credentials offline, granting access to SSH or Shellinabox management interfaces.
Command Injection Leads to Root Access
Once attackers gain access to management functions, they could exploit 19 OS command-injection vulnerabilities across various API and CGI endpoints.
Researchers found that multiple backend functions improperly concatenate user-controlled input into operating system commands without sufficient sanitization. Functions related to contact-list imports, network configuration, and firmware updates are among those affected.
By injecting shell metacharacters through crafted JSON data or uploaded files, an attacker could force the underlying Linux system to execute arbitrary commands. Since these services operate with elevated privileges, successful exploitation could lead to root-level code execution on the XWEB controller.
Team82 validated the potential cyber-physical impact using a test setup comprising an XWEB Pro controller, an XR60CX field controller, and a custom mini refrigerator. The field controller communicated with the XWEB device through Modbus over a serial connection.
Researchers reverse-engineered undocumented Modbus registers to remotely control field-controller functions. Their Python proof of concept could alter the temperature displayed on the XR60CX and independently turn physical components on or off.
During the demonstration, the researchers continuously displayed the legitimate sensor temperature while turning off the cooling fans. As a result, the refrigerator gradually warmed up, but its display appeared normal. This scenario illustrates an attack that could delay detection and lead to the spoilage of refrigerated contents.
Organizations using affected Copeland XWEB Pro devices should prioritize upgrading to firmware version 1.13, restrict management interfaces from exposure to the Internet, segment operational technology networks, and monitor for unusual changes in controller configurations or Modbus activity.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
