Dixell XWEB EVO refrigeration controller flaws: 14 vulns give root access, two actively exploited
Severity: critical · Patch status: patched · Since 2026-11-13
VulnCheck disclosed 14 vulnerabilities in Copeland's Dixell XWEB EVO refrigeration supervision system, all of which grant root access; severity scores range from 8 to 9.8 and at least two are under active exploitation. Researcher Valentin Lobstein found the login page executes the submitted username as a shell command before password checks. The same product family was affected in the October hack of refrigeration controllers at 700 French supermarkets, attributed by French authorities to the Iranian government. Separately, XBOW honeypots mimicking these controllers were probed within a day, with an attacker changing virtual freezer temperatures. Copeland coordinated disclosure with VulnCheck and patches are available; legacy unpatched versions remain exposed. Copeland urges keeping devices off the public internet and updating firmware.
What to do
- Immediately apply the latest Copeland/Dixell XWEB EVO firmware and software patches
- Ensure XWEB controllers and supervisory systems are not exposed to the public internet; restrict to isolated OT networks
- Review access logs for signs of exploitation or unauthorized temperature-setting changes
- Enforce strong, unique credentials and disable legacy unpatched versions
- Monitor industrial controllers for anomalous probes and login attempts
Fixed versions
- latest patched XWEB EVO software/firmware
Sources
All live incidents on Threat Watch
