Hackers Can Sabotage Refrigeration Systems, Masking Spoilage with Fake Displays
Twenty-three vulnerabilities in Copeland XWEB Pro controllers allow attackers to disable cooling while faking normal temperatures, potentially causing widespread spoilage without detection.
Cybersecurity researchers at Claroty Team82 have identified a critical set of 23 vulnerabilities within Copeland's XWEB Pro supervisory controllers, devices integral to the management of commercial refrigeration systems across various industries. These controllers are widely deployed in supermarkets, food storage warehouses, and healthcare facilities, where they meticulously monitor and log temperatures to ensure compliance with safety and regulatory standards.
The discovered flaws, 21 of which are rated as high severity, collectively grant unauthenticated remote attackers the ability to achieve full root-level control over the affected devices. This level of access allows for profound manipulation of the refrigeration systems' operations. The architecture typically involves a supervisory controller like the XWEB, which is internet-connected, communicating with lower-level field controllers that manage individual components such as compressors and fans.
Two specific vulnerabilities stand out for their exploitability. CVE-2026-25085 exploits a logic error in the system's handling of unrecognized login types. Instead of rejecting invalid login attempts, the controller returns an empty data structure that the software misinterprets as valid, thereby bypassing authentication entirely. This allows attackers to access restricted administrative functions without needing any credentials.
Compounding this issue is CVE-2026-21718, which enables attackers to calculate administrator passwords offline. The device generates its SSH and web interface passwords using a predictable algorithm based on the current date, the device's MAC address, and hardcoded secret keys within the firmware. Since the date is publicly known and the MAC address is easily obtainable, an attacker can systematically derive the daily administrative password and gain privileged access.
Once authentication is bypassed, researchers found an additional 19 command injection vulnerabilities. These flaws are present across various device functions, including firmware updates and network settings. Attackers can inject malicious system commands disguised as normal data inputs, ultimately granting them complete root access to the controller and the ability to execute arbitrary code.
To demonstrate the real-world implications, Claroty's researchers simulated an attack on a mini-refrigerator setup. They successfully manipulated the temperature display to show any desired reading while simultaneously disabling the cooling mechanisms. This allowed the contents of the refrigerator to spoil undetected, as the display continued to report normal, safe temperatures, highlighting a silent and potentially devastating form of sabotage.
Copeland has responded to the disclosure by releasing firmware version 1.13, which addresses all 23 identified vulnerabilities. The company urges all users of XWEB Pro controllers to update their systems immediately, given the remote and unauthenticated nature of the exploits. This incident underscores the critical need for robust security in operational technology (OT) environments, where vulnerabilities can lead to significant physical damage, financial loss, and compromise of essential services.