L3 · ShartedCopeland · Dixell · XWEB EVO · OTcopeland-xweb-evo

Copeland XWEB EVO flaws expose refrigeration controllers to remote takeover

VulnCheck published 14 flaws in the unsupported XWEB EVO family and observed requests targeting two of them on its canaries. Legacy units can expose root command execution without a login, and predictable credentials remain in 5.8.8.

Disclosed: Nov 12, 2026; Public disclosure date
Severity: CVSS 9.3 × 3; 14 CVEs tracked here
Splash zone: Copeland and Dixell XWEB EVO units reachable over the network, including refrigeration management interfaces.; Copeland · Dixell · XWEB EVO · OT
In the wild: Disputed; VulnCheck saw crafted requests on canaries. Production compromise is unconfirmed.

What happened

A reachable legacy XWEB EVO management interface can expose configuration writes or root command execution without an account. On firmware up to 5.8.8, the batch also includes predictable credentials and routes to administrative or root access. The research narrative describes some Lua paths as legacy-only, while the CNA records list CVE-2026-124008, CVE-2026-124009, CVE-2026-124014 and CVE-2026-124015 through 5.8.8. The published range for CVE-2026-124015 starts at 5.6.2. Use the CNA ranges for triage and ask Copeland about the exact model and build. Version 5.6.2 removes the specific xwconsole.cgi exposure according to its advisory, while the batch still affects newer builds.

VulnCheck describes opportunistic traffic against its canaries. This establishes attempts, while the number of compromised production units and any operational damage remain unknown. CERT-FR previously named Copeland and Dixell XWEB among controllers compromised in the refrigeration attacks. The November probes do not identify which vulnerabilities were used in that operation.

What’s in the bowl

CVE-2026-124002CVSS 9.3

Username command injection

5.2.3 to before 5.7.0. The login username is processed by the shell before authentication.

CVE-2026-124003CVSS 8.5

Privileged Lua interpreter injection

Before 5.6.2. The setuid-root interpreter can pass crafted arguments to the shell.

CVE-2026-124004CVSS 9.3

Hardcoded Administrator backdoor

Before 5.6.2. A hardcoded credential grants an Administrator session.

CVE-2026-124005CVSS 9.2

Predictable daily administrator password

4.3.0 through 5.8.8. The daily credential can be calculated from the device MAC address and date.

CVE-2026-124006CVSS 9.2

Predictable Linux root password

Through 5.8.8. The root credential is deterministic and derives from the daily code on newer firmware.

CVE-2026-124007CVSS 9.2

Password field command injection

Before 5.6.2. Shell metacharacters in the password field can reach a command before authentication.

CVE-2026-124008CVSS 8.6

Device template command injection

5.2.3 through 5.8.8. An authenticated caller can inject commands through template handling.

CVE-2026-124009CVSS 8.6

Backup command injection

5.2.3 through 5.8.8. An authenticated caller can inject commands through the backup output path.

CVE-2026-124010CVSS 9.3

Unauthenticated root command execution

Before 5.6.2. A request to xwconsole.cgi can run commands as root without a login.

CVE-2026-124011CVSS 6.9

MAC address and clock disclosure

5.6.2 through 5.8.8. An unauthenticated endpoint exposes inputs for deriving the daily password.

CVE-2026-124012CVSS 9.2

Administrator daily-password bypass

5.6.2 through 5.8.8. The built-in Administrator account accepts the derived daily credential.

CVE-2026-124013CVSS 8.7

Configuration import command injection

5.6.2 through 5.8.8. Authenticated callers can inject shell input in configuration import or restore.

CVE-2026-124014CVSS 8.8

Unauthenticated configuration write

The CNA lists 4.3.0 through 5.8.8. A caller can overwrite the system configuration without a login.

CVE-2026-124015CVSS 8.2

Session bypass in password reset

The CNA lists 5.6.2 through 5.8.8. An unauthenticated caller can reset an account flagged to change its password at next login.

Fixed versions

Product	Safe from	Note
XWEB EVO through 5.8.8	No fix	End of software support. No release addresses the entire batch.

Crime-scene timeline

Mar 16, 2026
Copeland ends software support
Copeland recommends XWEB PRO as the replacement and interim network restrictions for EVO.
Nov 12, 2026
The CNA publishes 14 vulnerability records
The batch covers command execution, predictable credentials, configuration access and password reset bypass.
Nov 12, 22:00 UTC
A VulnCheck canary detects configuration-write attempts
Requests matched CVE-2026-124014. VulnCheck counted 125 hits through November 13 at 06:16 UTC.
Nov 13, 03:41 UTC
A second source probes the legacy root endpoint
Four CVE-2026-124010 requests to the canaries asked the endpoint to run id, without a second stage reported.
Nov 13, 2026
VulnCheck publishes its firmware analysis and telemetry
The report describes lab reproduction and the two observed request patterns.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

VulnCheck original XWEB EVO researchPrimaryReports 14 findings, lab reproduction and two observed request patterns.
VulnCheck CNA record for CVE-2026-124014PrimaryLists 4.3.0 through 5.8.8 as affected by configuration write.
VulnCheck CNA record for CVE-2026-124015PrimaryLists 5.6.2 through 5.8.8 as affected by password-reset bypass.
Copeland XWEB EVO end-of-support bulletinPrimaryEnds software support on March 16, 2026 and recommends migration and interim controls.
Copeland network security guidancePrimaryAdvises removing internet access, filtering traffic and restricting SSH.
CERT-FR refrigeration controller alertPrimaryDocuments earlier compromises of controllers including Copeland and Dixell XWEB, with safe restoration guidance.

Wipe guide

The wipe checklist

0 of 3 sheets used

Remove direct access to the controllerWork with facilities staff and the refrigeration contractor. Identify EVO model and firmware from inventory or its management console. Remove public port forwards and restrict inbound and outbound traffic on a dedicated network. Allow HTTPS management and necessary SSH access only from approved hosts via controlled remote access. Verify alarms and refrigeration monitoring still function.
Hunt for the requests recorded by VulnCheckSearch firewall, proxy and device logs for 202.61.138.117 (AS152194), unauthenticated POST to config.lua with action=set, and 177.4.12.11 (AS140227), unauthenticated GET to /cgi-bin/xwconsole.cgi with a sh parameter. The observed GETs used sh=id and User-Agent Mozilla/5.0. The canary rules are VULNCHECK CVE-2026-124014 Copeland XWEB EVO Unauthenticated config.lua Configuration Write Attempt and VULNCHECK CVE-2026-124010 Copeland XWEB EVO xwconsole.cgi Unauthenticated Root Command Execution Attempt. Compare /etc/xwebconfig.json with a trusted baseline and check for unexpected administrator sessions, SSH enablement and defrost or alarm changes. A match alone does not prove compromise.
Recover and replace affected EVO devicesPreserve available logs and settings. If compromise is suspected, coordinate safe isolation with the refrigeration contractor. Follow vendor guidance to recover with known-good firmware and configuration or replace the device. Rotate operator and remote-access credentials from a clean system. Copeland recommends moving to a supported XWEB PRO model. Verify current firmware and advisories for the replacement model before reconnecting it.