Critical Vulnerabilities Found in Copeland XWEB Pro Refrigeration Controllers

• •23 vulnerabilities identified in Copeland XWEB Pro, 21 rated high severity.
• •Attackers could exploit flaws for root-level remote code execution.
• •Claroty's research emphasizes the need for enhanced cybersecurity in industrial refrigeration.

Claroty's Team82 research unit identified 23 vulnerabilities in Copeland's XWEB Pro refrigeration controllers, with 21 rated as high severity. These flaws could allow unauthenticated attackers to gain root-level remote code execution, enabling them to manipulate refrigeration systems. The vulnerabilities stem from authentication bypasses, predictable administrator credentials, and command-injection issues. Additionally, multiple vulnerabilities were found in Danfoss AK-SM 800A controllers, including serious authentication bypass issues. The potential impact includes the ability to spoil food and other temperature-sensitive items. Claroty's findings were presented at DEF CON 34, highlighting the need for improved cybersecurity in industrial refrigeration systems. This research positions Claroty as a leader in operational technology security, particularly in critical infrastructure. The vulnerabilities pose significant risks to organizations relying on these systems.