VulnCheck disclosed 14 vulnerabilities on November 13 in XWEB EVO, the Dixell refrigeration supervisor now sold under Copeland, and said its sensors had recorded attackers exploiting two of them. A Copeland product handout lists restaurants, large hotel kitchens and hospital and university kitchens among the markets for XWEB, so the disclosure concerns kitchen refrigeration in hospitality as well as in supermarkets.
The most severe flaw, CVE-2026-124010, lets one unauthenticated web request run commands as root on pre-2021 builds. The other exploited flaw, CVE-2026-124014, writes the system configuration file without a login. VulnCheck said the first exploitation hits arrived an hour and forty minutes after the NVD record went live. On the 5.8.8 firmware, which VulnCheck describes as end-of-support, the Administrator “code of the day” can be computed from the device MAC address and the date, and a separate page returns that MAC address to anyone who asks.
The handout explains what sits on the box in a kitchen. XWEB schedules defrost cycles, raises temperature and door alarms, exports HACCP and food quality records, and “Can be accessed via the Internet with a static IP address”. In October France’s CERT-FR named Copeland and Dixell xweb among refrigeration controllers it knew to be compromised, and told owners to remove internet exposure, check defrost settings and allow remote access only through a VPN.
In our reading, the first job for a restaurant group’s facilities lead or a hotel’s chief engineer is an inventory: which sites run an XWEB unit, on which firmware, and whether the refrigeration contractor reaches it over a public IP address. CERT-FR also advises checking insurance terms before cutting the contractor’s data feed. The same review belongs beside other outside-managed building systems, such as the energy service Catalyst Power launched for hotels, and in the integration checklist operators already apply to restaurant technology purchases.
Source: VulnCheck
