Reported by 2 outlets
Critical Copeland XWEB Pro Flaw Lets Remote Attackers Take Control of Refrigeration Systems
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Critical Copeland XWEB Pro Flaw Lets Remote Attackers Take Control of Refrigeration Systems
cyberpress.org · 63d ago · August 11th, 2026
A newly disclosed 23 vulnerabilities in Copeland XWEB Pro commercial refrigeration controllers, including an authentication bypass and predictable credential-generation flaws that can allow unauthenticated remote attackers to obtain root-level code execution. The issues, disclosed by Claroty’s Team82 research unit, affect the Copeland XWEB Pro product family, including the XWEB300D PRO and XWEB500D PRO. Copeland has released firmware version 1.13 to address the vulnerabilities. XWEB Pro devices act as supervisory controllers in commercial refrigeration environments. They connect enterprise networks to distributed field controllers, allowing operators to remotely monitor alarms, review temperature records, and manage refrigeration equipment. Critical Copeland XWEB Pro Flaw In a typical deployment, the XWEB controller communicates with field devices through an RS485 serial network using Modbus. Those field controllers directly operate compressors, cooling fans, defrost heaters, lighting, and temperature sensors across refrigeration units. This architecture makes the XWEB controller a particularly valuable target. Compromising a single exposed supervisory device could give an attacker centralized access to multiple connected refrigeration systems across supermarkets and distribution centers. Typical commercial refrigeration control architecture (Source: Team 82) One of the most severe flaws, tracked as CVE-2026-25085, exists in the device’s Lua-based web authentication logic. Th
-
update from gbhackers.com
Copeland XWEB Pro Vulnerabilities Let Attackers Gain Root Access and Manipulate Refrigeration Systems
gbhackers.com · 63d ago · August 11th, 2026
Security researchers have discovered 23 vulnerabilities in Copeland’s XWEB Pro commercial refrigeration controllers, with 21 rated as high severity. Claroty’s Team82 found that an attacker could exploit a combination of authentication flaws, predictable administrator credentials, and command-injection vulnerabilities […] The post Copeland XWEB Pro Vulnerabilities Let Attackers Gain Root Access and Manipulate Refrigeration Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .