Researchers at VulnCheck have disclosed 14 vulnerabilities in Copeland’s Dixell XWEB EVO refrigeration supervision system. At least two are being exploited in real attacks.
What was found
XWEB is one of the systems named in the October attack on French supermarkets. VulnCheck researcher Valentin Lobstein began looking at its access controls earlier this year. Many of the resulting findings carry severity scores between 8 and 9.8, and lab testing indicated that each could give an attacker administrative or root access to the device.
The most striking example reported: the login page runs the submitted username as a system command before it checks the password. No valid account is needed.
Vendor response
VulnCheck worked with Copeland and Dixell before publication, and fixed software is available. Copeland is urging customers to update and to keep the devices off the public internet, and says it has contacted customers directly. Older, legacy versions of the supervisor remain exposed.
How quickly exposed devices are found
A researcher at XBOW set up decoy servers imitating the affected models, got them indexed by a device search engine, and presented them as a fictional pizza chain. Within a day they were being probed, and someone had logged in and changed the temperature of a simulated freezer.
What to do
- Inventory XWEB and similar supervisors, including those installed and maintained by contractors.
- Update to the patched release; plan replacement for versions that no longer receive fixes.
- Remove direct internet exposure. Search engines for connected devices will find it before you do.
- Review logs for unexpected logins and setpoint changes since October.