VulnCheck discloses 14 root-access flaws in Dixell refrigeration units

VulnCheck disclosed details on 14 vulnerabilities in Dixell refrigeration units manufactured by Copeland on Nov. 13, 2026. CyberScoop reported the research.

The company said it discovered the flaws earlier in 2026. Testing against rebuilt vendor firmware showed that every flaw would give an attacker root or administrative access to a compromised unit. Root access means an attacker can take full control of a device.

At least two of the flaws are being actively exploited in the wild. Many carry severity scores of 8 to 9.8.

The flaws affect the XWEB EVO supervision system from Dixell and Copeland. In October, an attack on refrigeration controllers affected 700 supermarkets across France, and XWEB EVO was one of four systems hit. French authorities blamed the Iranian government for those hacks at supermarkets.

Reuters reported that suspected cyber attacks hit refrigeration units belonging to the U.S. military. Businesses operating refrigeration units across the U.S. and Europe are recovering from recent hacking incidents, and threat intelligence firms have disclosed more than a dozen serious vulnerabilities in popular products.

Cold-chain means temperature-controlled storage and transport. Operational technology is the hardware and software that monitors and controls physical equipment. Attackers with root access to cold-chain refrigeration units and operational technology refrigeration units can change temperature settings and potentially take control of supermarket, military and other critical-infrastructure devices.

Valentin Lobstein of VulnCheck began reviewing XWEB after learning that a compromised device from another vendor had set its administrative password to that day’s date. Lobstein and VulnCheck told Copeland and Dixell about the problems and helped with fixes before the public disclosure.

Fixes for the vulnerabilities are available now. Earlier versions of the supervisory system remain exposed to possible takeover.

CyberScoop reported that Copeland confirmed some XWEB monitoring solutions are affected. Copeland told customers to keep units off the public internet and install patched software that is current. A spokesperson for Copeland said customers should keep units away from the public internet and keep software and firmware current.

Copeland said it contacted customers to repeat guidance on earlier cybersecurity best practices and patching. Copeland said its teams stand ready to support customers as needed.

Max Günther of XBOW set up fake honeypot servers online that imitated affected vendors and models for a fake pizza store chain. Honeypot servers are decoy systems built to attract and observe attacks. Günther indexed the honeypot servers using search engines such as Shodan and built a dashboard to show the potential real-world impact of hacks. Within a day of deployment, attackers probed the honeypot servers, and some attempted to access and change temperature settings.

Earlier this week, Günther wrote on LinkedIn that he saw hundreds of requests, including generic PHP2Shell-related exploit probes and actual attempts to log in to simulated refrigeration controllers. Earlier this week, Günther wrote on LinkedIn that someone appeared to log in and alter the temperature of one virtual freezer, defrosting all virtual pizzas inside. Valentin Lobstein said, “The login page runs the submitted username as a shell command before it ever checks the password.”