Claroty Team82 has uncovered 23 vulnerabilities in Copeland’s XWEB Pro supervisory controllers, widely used to manage commercial refrigeration in supermarkets, warehouses, and hospitals.
Of these, 21 are rated high severity, and together they allow an unauthenticated attacker to gain full root-level control of the device over the network.
Commercial cooling systems rely on a layered setup. A supervisory controller sits at the top, connected to the internet. In contrast, field controllers below it manage individual units, such as compressors and fans, via a serial connection.
The Copeland XWEB300D and XWEB500D PRO controllers are central to this setup, tracking temperature logs required for food safety and health regulations.
Commercial refrigeration control system managing multiple units (Source: Team 82)
One flaw, tracked as CVE 2026 25085, stems from a coding logic error. When a user submits an unrecognized login type, the system should reject it.
Instead, it returns an empty data structure that the software mistakenly treats as valid. This allowed attackers to bypass login checks entirely and access restricted administrative functions without credentials.
A second flaw, CVE 2026 21718, is arguably more dangerous. The device generates its administrator SSH and web passwords using only the current date, the device’s MAC address, and secret keys hidden in the firmware.
An XWEB500D PRO controller unit (Source: Team 82)
Since the date is public and the MAC address is easy to retrieve, an attacker can calculate the exact daily password offline and log in as an administrator.
After bypassing authentication, researchers found 19 separate command injection flaws across various device functions, including firmware updates and network settings. These allow attackers to insert hidden system commands into normal-looking data, granting them complete root access to the controller.
To demonstrate real-world impact, researchers built a working mini-refrigerator connected to an XWEB controller and an XR60CX field unit.
Using a custom Python tool, they demonstrated how to set the display to any arbitrary temperature between -50 and 110 degrees Celsius.
An HTTP request that exploits the authentication bypass to access a device-protected endpoint (Source: Team 82)
More alarmingly, they showed an attack in which the display kept showing the correct temperature while the cooling fans were silently switched off in the background. The refrigerator slowly warmed, spoiling its contents, with no visible warning on the screen.
Claroty reported these issues to Copeland, which released firmware version 1.13 to patch all 23 vulnerabilities. Facilities using XWEB Pro controllers should update immediately, since exploitation requires no valid credentials and can be carried out remotely over the internet.
This research highlights a growing risk in operational technology: software bugs in industrial controllers can directly cause physical damage, from spoiled groceries to ruined medical supplies.
Experts recommend removing these controllers from direct internet exposure, segmenting refrigeration networks from other systems, and applying vendor patches promptly to prevent similar silent sabotage attacks.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Hackers Can Turn Off Refrigeration While the Temperature Display Still Looks Normal appeared first on Cyber Security News.
