# Researchers Expose Refrigeration Control Vulnerabilities

VulnCheck disclosed 14 vulnerabilities in Copeland/Dixell XWEB EVO refrigeration supervision systems. Testing found that each flaw could enable root or administrative access, and at least two are reportedly being actively exploited. Patches are available, but legacy versions remain exposed. Government facility managers and contractors responsible for connected refrigeration controls should review internet exposure, keep affected units off the public internet, and apply current software and firmware. The signal identifies no specific solicitation, contract, or procurement event.

- Facility operators can use the disclosures to prioritize exposure reviews and patching for XWEB EVO systems, including legacy installations.
- Contractors supporting government facilities may need to account for connected industrial-control security when maintaining or upgrading refrigeration systems.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 13, 2026

### Government Entities
- U.S. military

### Vendors
- Copeland/Dixell (Refrigeration supervision system manufacturer)

### Key Quotes
> I’ve already seen hundreds of requests, everything from generic PHP2Shell-related exploit probes to actual attempts to log in to the simulated refrigeration controllers.
> — Max Günther, XBOW Researcher

> The login page runs the submitted username as a shell command before it ever checks the password.
> — Valentin Lobstein, Security Researcher

### Sources
- [Researchers continue to find serious vulnerabilities in internet connected refrigerators | CyberScoop](https://cyberscoop.com/copeland-dixell-refrigeration-vulnerabilities) - CyberScoop