A newly disclosed 23 vulnerabilities in Copeland XWEB Pro commercial refrigeration controllers, including an authentication bypass and predictable credential-generation flaws that can allow unauthenticated remote attackers to obtain root-level code execution.
The issues, disclosed by Claroty’s Team82 research unit, affect the Copeland XWEB Pro product family, including the XWEB300D PRO and XWEB500D PRO. Copeland has released firmware version 1.13 to address the vulnerabilities.
XWEB Pro devices act as supervisory controllers in commercial refrigeration environments. They connect enterprise networks to distributed field controllers, allowing operators to remotely monitor alarms, review temperature records, and manage refrigeration equipment.
Critical Copeland XWEB Pro Flaw
In a typical deployment, the XWEB controller communicates with field devices through an RS485 serial network using Modbus. Those field controllers directly operate compressors, cooling fans, defrost heaters, lighting, and temperature sensors across refrigeration units.
This architecture makes the XWEB controller a particularly valuable target. Compromising a single exposed supervisory device could give an attacker centralized access to multiple connected refrigeration systems across supermarkets and distribution centers.
One of the most severe flaws, tracked as CVE-2026-25085, exists in the device’s Lua-based web authentication logic. The affected application processes HTTP Basic Authentication requests and expects a recognized authentication mode, such as local accounts or LDAP.
However, Team82 found that supplying an unexpected authentication mode caused the backend authentication function to return an empty Lua table instead of explicitly rejecting the request.
Because Lua treats tables as truthy values, the application’s router accepted the malformed authentication object and granted access to protected administrative API routes.
The vulnerability allows an attacker to bypass authentication without valid credentials. Once inside the management interface, an adversary could access features intended only for privileged administrators.
A separate issue, CVE-2026-21718, involves deterministic administrator password generation. The platform derives daily web and SSH passwords from the device’s MAC address, the date, and hard-coded secrets embedded in firmware.
Since the MAC address and date can be exposed through public endpoints, and the shared keys can be recovered from firmware, an attacker could reproduce the password-generation process offline.
After bypassing authentication or deriving administrator credentials, attackers could exploit 19 OS command-injection vulnerabilities identified across API and CGI endpoints.
According to Team82, multiple functions that handle tasks such as network configuration, contact list imports, and firmware updates concatenate user-controlled input into operating system commands.
Improper sanitization enables shell metacharacters embedded in crafted requests or files to alter command execution. Because the vulnerable services run with elevated privileges, successful exploitation can result in root-level remote code execution on the XWEB controller.
Team82 validated the impact in a live test environment using an XWEB Pro controller, an XR60CX field controller, and a custom mini refrigerator.
The Amir reverse-engineered relevant Modbus registers and developed a Python proof of concept to manipulate the field controller through the compromised supervisory device.
The proof of concept kept the temperature display aligned with the legitimate probe reading while disabling cooling fans, causing the refrigerator to warm without visibly alerting an operator.
Organizations using affected XWEB Pro systems should urgently deploy firmware 1.13, remove management interfaces from direct Internet exposure, segment operational networks, restrict administrative access, and monitor for anomalous SSH, web, Modbus, and controller-configuration activity.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
