On 12 November 2026, VulnCheck disclosed 14 vulnerabilities in Copeland XWEB EVO, the refrigeration supervisor first sold under the Dixell brand and now sold by Copeland, the former Emerson climate business. VulnCheck assigned the identifiers CVE-2026-124002 through CVE-2026-124015 as a CVE Numbering Authority (CNA), an organization allowed to issue Common Vulnerabilities and Exposures (CVE) numbers. The official records went live on the National Vulnerability Database (NVD) at 2:18 PM Central time. About an hour and forty minutes later, VulnCheck's canary sensors, which are decoy systems built to attract and record attacks, began logging real attacks against one of the flaws, CVE-2026-124014. No public exploit code existed at the time. VulnCheck recorded 87 attempts in the first hour from a single source address and added the flaw to the VulnCheck Known Exploited Vulnerabilities (KEV) list the same day. VulnCheck published its full write-up on 13 November.
CVE-2026-124014 lets someone who has not logged in overwrite the supervisor's main system configuration file through its web interface. Its CVE record lists versions 4.3.0 through 5.8.8 as affected, which includes the final firmware, and says the flaw can be used to tamper with settings or to put the device into an unconfigured state that takes it out of service. The most severe of the 14 is CVE-2026-124010, which lets an attacker who has not logged in run commands as root, the all-powerful administrator account of the underlying Linux system, on versions before 5.6.2. Those older builds also carry command injection in the login page and a hardcoded backdoor password, and VulnCheck says they still make up most of the units reachable from the internet.
The final firmware, version 5.8.8, is not safe either. Its administrator password is a daily "code of the day" that anyone can calculate from the device's network hardware address and the date (CVE-2026-124005 and CVE-2026-124012). The device gives that address and its clock to anyone who asks (CVE-2026-124011), and the Linux root password is rebuilt each day from the same code (CVE-2026-124006). Once logged in, an attacker can also inject commands through the import feature (CVE-2026-124013).
Copeland ended software support for the whole XWEB EVO family on 16 March 2026, after it stopped selling the product in October 2023, so these flaws will not be fixed. Copeland's own bulletins tell owners to remove every XWEB EVO from the public internet, use a virtual private network (VPN) for remote access, check and restore units from the local network, and move to the supported XWEB PRO line, which Copeland says should not be exposed to the internet either. VulnCheck counted roughly 1,663 XWEB EVO systems on the internet in data from Shodan, a search engine for internet-connected devices, and the Onyphe internet survey counted about 1,960.
VulnCheck describes the attacking host, 202.61.138.117 (on network AS152194, which belongs to a commercial hosting provider), as an opportunistic scanner reacting to the new record. It is not the October campaign that France attributed to Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC). The two still connect. France's national cyber agency, CERT-FR, had already named Copeland and Dixell XWEB among the controllers compromised in the October attacks on European supermarkets (CERTFR-2026-ALE-012), when refrigeration was forced into defrost overnight and stock was lost. At the time of writing, this flaw was not in the Cybersecurity and Infrastructure Security Agency (CISA) KEV catalog, and CISA had not issued an industrial control system advisory for XWEB EVO. Earlier Red Tiger advisories cover the campaign: https://www.redtigersecurity.com/advisory/certfr-refrigeration-controllers-campaign , https://www.redtigersecurity.com/advisory/france-attributes-refrigeration-attacks-irgc , https://www.redtigersecurity.com/advisory/us-refrigeration-cold-chain-csa and https://www.redtigersecurity.com/advisory/danfoss-ak-sm800a-unpatched-zero-days .
An XWEB supervisor usually sits in a supermarket back office, machine room or electrical panel. It watches and controls the case controllers, compressor racks, cold rooms and defrost schedules for the whole store, and it sends alarms and temperature records to the owner, the refrigeration contractor or a cloud monitoring service. The same supervisors run cold storage warehouses, food and beverage distribution centers, pharmaceutical cold chain sites where temperature records decide whether product can be released, and refrigerated storage at ports. Many are reached by contractors through a port forwarding rule on the store router or through a cellular modem. That path from the equipment room to the internet is exactly what attackers are using.
Red Tiger has completed more than 500 operational technology (OT) security assessments and trained more than 4,500 people, and contractor-managed refrigeration and building equipment is one of the most common blind spots the team finds. Red Tiger does more than find and fix weaknesses like this one. The team can also install a firewall and sensor at the site, connect it to the Red Tiger 24x7 Security Operations Center (SOC), and monitor the site for ongoing detection and response as a 24x7 managed service with metrics and reports, so an unexpected connection to a refrigeration supervisor is spotted and handled quickly.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: VulnCheck disclosure, 13 November 2026 https://www.vulncheck.io/blog/copeland-xweb-evo-unauthenticated-root ; NVD record for CVE-2026-124014 https://nvd.nist.gov/vuln/detail/CVE-2026-124014 ; Copeland end of software support bulletin, March 2026 https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf
Check out our resources and book a follow-up call with our team.
