VulnCheck discloses 14 root flaws in Copeland Dixell XWEB, two exploited
Original title: Researchers continue to find serious vulnerabilities in internet connected refrigerators
Patches exist, but legacy XWEB builds stay exposed; honeypots were probed and one virtual freezer temperature was changed.
VulnCheck published 14 vulnerabilities in Copeland Dixell XWEB EVO refrigeration controllers that lab tests showed would give root or administrative access. Many score between 8 and 9.8, and at least two are exploited in the wild. The login page runs the submitted username as a shell command before checking the password. Copeland confirmed some XWEB monitoring products are affected, said patches are available, and told customers to stay off the public internet. XWEB EVO was among systems hit in an October incident at 700 French supermarkets.
Unconfirmed: Iran's role is a French government accusation, and U.S. military refrigeration incidents are only suspected, according to Reuters.
- The login page runs the submitted username as a shell command.
- Legacy supervisory-system versions remain exposed after patches.
- Honeypots drew hundreds of probes, including a freezer temperature change.
- French authorities blame Iran for the supermarket controller hacks.
Impact: Root or administrative access to refrigeration controllers
| Product | Affected |
|---|---|
| Copeland XWEB EVO | — |
- 1.Update XWEB software and firmware to the latest patched release.
- 2.Keep Dixell and Copeland controllers off the public internet.
- Products
- XWEB EVO
- Countries
- FranceIranUnited States
From the original article
4 min read at cyberscoop.com
VulnCheck disclosed 14 vulnerabilities in Dixell refrigeration units that give an attacker root access, while online honeypots are being flooded with hacks and malicious probes. The post Researchers continue to find serious vulnerabilities in internet connected refrigerators appeared first on CyberScoop.
By djohnson · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.