Researchers have disclosed over a dozen serious security vulnerabilities in Dixell refrigeration units, manufactured by Copeland. These vulnerabilities also affect the XWEB EVO supervision system.
The severity scores of these vulnerabilities range between 8 and 9.8, indicating a high level of risk. At least two of these vulnerabilities are confirmed to be under active exploitation in the wild.
The vulnerabilities were disclosed following notifications by VulnCheck to Copeland and Dixell, which assisted in addressing the issues. Despite these efforts, French authorities have attributed recent supermarket hacks to the Iranian government.
The October incident impacted refrigeration controllers in 700 supermarkets across France. Additionally, Danfoss controllers, which were also updated, remain vulnerable according to Germany's Federal Office for Information Security (BSI).
The BSI has warned that even with new patches, the discovery of further vulnerabilities cannot be ruled out. Midnight Blue researchers identified serious flaws in Danfoss controller software that could allow pre-authentication remote code execution.