Critical Vulnerability in Emerson Controllers Lets Attackers Spoof Temperatures

Key Takeaways

• Cybersecurity researchers uncovered 23 vulnerabilities, 21 of which are high severity, in Emerson’s Copeland XWEB Pro supervisory controllers.
• These flaws allow unauthenticated attackers to gain full root-level control and manipulate critical temperature readings in commercial refrigeration systems.
• The affected controllers are widely used in supermarkets, warehouses, and hospitals, posing risks to food safety and medical supplies.
• Emerson has released firmware version 1.13 to patch all identified vulnerabilities.

Critical Flaws in Emerson Controllers Enable Temperature Spoofing, Full System Control

Twenty-three vulnerabilities, including 21 rated as high severity, have been discovered in Emerson’s Copeland XWEB Pro supervisory controllers. These critical flaws could allow unauthenticated attackers to remotely gain complete root access to the devices, enabling them to falsify temperature data and potentially cause significant physical damage, from spoiled perishables to compromised medical supplies.

The findings, reported by Claroty Team82, highlight a severe security risk within the critical infrastructure of commercial refrigeration systems. These controllers are integral to maintaining precise environmental conditions in various settings, including supermarkets, large-scale warehouses, and healthcare facilities.

The Architecture of Vulnerability

Commercial cooling systems operate with a hierarchical structure. At the apex, a supervisory controller, often connected to the internet, oversees the entire network. Below it, field controllers manage individual components like compressors and fans through serial connections. The Copeland XWEB300D and XWEB500D PRO controllers are central to this setup, responsible for logging temperature data crucial for regulatory compliance and safety standards.

Authentication Bypass and Predictable Passwords

Among the identified vulnerabilities, two stand out for their severity. The first, tracked as CVE-2026-25085, is a logic error in the authentication process. Instead of rejecting unrecognized login types, the system incorrectly processes an empty data structure as valid. This allows attackers to completely bypass login checks and access restricted administrative functions without requiring any credentials.

The second critical flaw, CVE-2026-21718, is arguably more concerning. The device generates its administrator SSH and web passwords using a combination of the current date, the device’s MAC address, and secret keys embedded in the firmware. Since the current date is publicly available and the MAC address can be easily retrieved, an attacker can calculate the exact daily password offline, enabling them to log in as an administrator without needing to interact with the device directly.

Command Injection Leads to Root Access

After bypassing the initial authentication mechanisms, researchers identified 19 distinct command injection vulnerabilities across various device functionalities, including firmware updates and network configurations. These flaws permit attackers to embed hidden system commands within seemingly normal data inputs, granting them full root-level access to the controller.

Real-World Impact: Silent Sabotage

To illustrate the tangible risks, researchers constructed a miniature working refrigerator connected to an XWEB controller and an XR60CX field unit. Using a custom Python tool, they successfully manipulated the displayed temperature to any value between -50 and 110 degrees Celsius.

More alarmingly, they demonstrated an attack where the controller continued to display the correct temperature while silently deactivating the cooling fans in the background. The refrigerator’s contents slowly warmed and spoiled without any visible warning on the display, highlighting the potential for covert and destructive sabotage.

Claroty reported these issues to Copeland, which has since released firmware version 1.13 to address all 23 vulnerabilities. Given that exploitation requires no valid credentials and can be executed remotely over the internet, facilities utilizing XWEB Pro controllers are urged to update their systems immediately.

This research underscores the increasing danger posed by software vulnerabilities in operational technology, where bugs in industrial controllers can lead directly to physical consequences, from food spoilage to the ruination of critical medical supplies.

What You Should Do

• Immediately update all Copeland XWEB Pro supervisory controllers to firmware version 1.13.
• Remove these controllers from direct internet exposure by placing them behind firewalls or in segmented network zones.
• Implement network segmentation to isolate refrigeration networks from other critical IT and operational technology systems.
• Regularly monitor network traffic to and from these controllers for any unusual activity or unauthorized access attempts.
• Review and strengthen access control policies for all industrial control systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.