XWEB EVO configuration flaw exploited within 100 minutes
VulnCheck disclosed 14 vulnerabilities in Dixell/Copeland XWEB EVO refrigeration supervisors and says attackers exploited one unauthenticated configuration-write flaw within 1 hour 40 minutes of its bare National Vulnerability Database (NVD) record appearing. No public proof of concept existed.
The exploited flaw lets an unauthenticated request write the appliance’s system configuration. A separate flaw on pre-2021 builds is more direct: the login page passes the submitted username to a system command before checking the password, and that interpreter runs as root. A failed login can therefore still execute commands with full device privileges.
The 2021 rewrite removed this command-injection class, but legacy units remain exposed; firmware 5.8.8 is also end-of-support and has separate reported weaknesses. For XWEB EVO operators, a corrected newer branch—or the absence of a public exploit—does not establish that every deployed supervisor is outside the exposure.
Code of the Day: Unauthenticated Root in Copeland XWEB EVO | Blog | VulnCheck
VulnCheck's Initial Access Intelligence team discloses 14 vulnerabilities in the Dixell / Copeland XWEB EVO refrigeration supervisor, including unauthenticated remote root on both the legacy builds and the current end-of-support firmware, where the login handler runs the submitted username as a shell command before the password check, the interpreter behind every page is setuid root, and the daily admin credential is a secret-free function of the device MAC and the date.