Refrigeration as Critical Infrastructure: Beyond Danfoss, the Exposure of Copeland/Dixell Supervisory Systems

Building on the previous investigation into the exposure of Danfoss StoreView controllers, ONYPHE expands its analysis to three other families of supervisory systems: Copeland Site Supervisor, XWEB EVO, and XWEB PRO.

The study reveals several thousand interfaces accessible from the Internet, insecure remote access configurations, and software versions associated with known vulnerabilities. Some Site Supervisor interfaces also allow unauthenticated access to detailed operational information, including temperatures, pressures, alarms, equipment status, and sometimes even store floor plans.

This second part provides an overview of their exposure and an analysis of the associated risks, without assuming any involvement in the recent cyberattacks targeting the retail sector.

A Campaign Extending Beyond Danfoss Equipment

In the first part of this investigation, an analysis of ONYPHE data revealed several thousand public IP addresses exposing Danfoss StoreView Browser interfaces across 95 countries. This mapping highlighted a particularly high concentration in France, a significant proportion of unencrypted HTTP access, and the continued use of outdated software versions.

Since that publication, new information has helped clarify the scope of the cyberattacks targeting refrigeration installations. On October 13, 2026, CERT-FR updated its CERTFR-2026-ALE-012 alert bulletin, reporting that the compromises also affected XWEB supervisory systems, originally developed as Emerson solutions and marketed under the Dixell brand, part of the Copeland group.

This information prompted us to expand the investigation to this product range. Searches conducted using ONYPHE data identified two families of Internet-accessible interfaces: XWEB EVO and XWEB PRO. While no publicly documented vulnerability was identified as explicitly affecting XWEB EVO, XWEB PRO controllers were the subject of research published in August 2026 by Claroty Team82, the same research team that discovered several vulnerabilities affecting Danfoss AK-SM 800A controllers. This connection motivated a closer examination of their exposure.

Further investigation into Copeland’s supervisory solutions also revealed a third family of interfaces: Site Supervisor, historically marketed under the Emerson brand. These devices are of particular interest: in addition to the numerous vulnerabilities documented by Armis Labs as part of its Frostbyte10 research, some exposed interfaces allow unauthenticated access to a wide range of operational information about monitored sites, including refrigeration system temperatures, gas pressure, lighting status, alarms, and other operating parameters. This visibility therefore extends beyond refrigeration alone and can reveal detailed information about a facility’s technical infrastructure, although it does not demonstrate that these parameters can be modified without authentication.

The ONYPHE investigation was therefore extended to these three families of interfaces, with two main objectives: to map their Internet exposure and examine publicly accessible information, in order to identify risky configurations and, where possible, software versions affected by known vulnerabilities.

This analysis does not assume that all these products were targeted during the October 2026 attacks. Rather, it aims to characterize a broader attack surface, extending beyond the Danfoss equipment initially investigated.

Mapping Exposed Copeland Interfaces

Detection Methodology

As with Danfoss StoreView interfaces, device identification relies on the analysis of HTTP and HTTPS scan data collected by ONYPHE.

Several types of indicators are used here: HTML titles, favicon fingerprints, TLS certificate characteristics, and distinctive elements found in HTTP responses. Combining these indicators makes it possible to identify interfaces associated with the three product families under investigation, while reducing the risk of false positives that may arise from relying on a single signature.

The results are then grouped by public IP address, country, and Autonomous System Number (ASN) to analyze their geographic distribution and the networks on which they are accessible.

As in the first part of this investigation, a public IP address does not necessarily correspond to a single physical device. Multiple controllers may be accessible behind the same IP address, while a single device may expose multiple services. The figures presented therefore represent IP addresses associated with the detected interfaces, rather than an exhaustive inventory of refrigeration installations.

Exposure Volume

The analysis reveals several thousand publicly accessible interfaces, with significant differences across the three product families.

Indicatpr	Danfoss StoreView	Site Supervisor	XWEB EVO	XWEB PRO
Unique public IP	6 212	589	1 960	108
Countries	95	21	65	28
Unique ASN	558	143	493	57
French IP address	2836	0	95	0

For comparison, the previous investigation identified 6,212 IP addresses associated with Danfoss StoreView, distributed across 95 countries and 558 ASNs.

Among the three Copeland product families analyzed, XWEB EVO has the largest exposure footprint, with 1,960 IP addresses identified. Its deployment also appears more geographically dispersed, spanning 65 countries and nearly 500 distinct autonomous systems. It is also the only one of the three with a significant presence in France. This observation is consistent with the CERT-FR advisory.

Site Supervisor accounts for 589 IP addresses, while XWEB PRO has a considerably smaller footprint, with 108 IP addresses.

These differences reflect the scan data collected for each product. They do not, on their own, indicate the relative size of their installed bases, as only services accessible and identified by ONYPHE are taken into account.

Geographic Distribution

The three solutions show significantly different geographic distributions. The analysis is based on data collected by ONYPHE over the past 7 days, a period corresponding to one complete scan cycle of the platform. This time window covers all targets scanned during a full cycle, providing a representative overview of the global exposure of these interfaces. The observed distributions are as follows:

• Site Supervisor is primarily observed in North America and Oceania. The United States accounts for more than half of the identified IP addresses, followed by Canada, Australia, New Zealand, and Italy. Together, the United States and Canada account for nearly 70% of the results.
• In contrast, XWEB EVO has a strong presence in Europe. Italy ranks first, followed by Belgium and Greece, then Spain and France.
• Finally, XWEB PRO shows a more dispersed distribution. Italy accounts for the largest share of identified IP addresses, followed by Bulgaria, the Philippines, Greece, and Israel.
  

This distribution is particularly interesting in light of the incidents reported in October 2026. While Danfoss StoreView shows a particularly high concentration in France, XWEB EVO and XWEB PRO interfaces are also widely represented across several other European countries, notably Italy and Belgium.

Network Configurations Similar to Those Observed with Danfoss

Exposure Primarily Through Telecom Operators

ASN analysis reveals a common characteristic across the different products studied: the interfaces are predominantly accessible through telecommunications operators‘ networks, rather than traditional hosting infrastructure:

• For XWEB devices, the most represented networks include Proximus, Telecom Italia, OTE, Fastweb, Orange, and Deutsche Telekom.
• For Site Supervisor, the results highlight North American operators such as Verizon Business, Comcast, TELUS, and SaskTel.

This pattern is consistent with what was observed in the Danfoss StoreView analysis, suggesting that a significant proportion of these controllers are accessible through the Internet connections of the sites where they are installed, enabling remote maintenance.

A Majority of Services Running on Non-Standard Ports Without TLS Encryption

For this section, we no longer count unique IP addresses but instead consider IP address-TCP port pairs. A single IP address may therefore be associated with multiple exposed interfaces, which do not necessarily correspond to distinct physical devices.

Indicators	Danfoss StoreView	Site Supervisor	XWEB EVO	XWEB PRO
Non-standard ports (other than 80, 443, and 8080)	88%	41%	80%	41%
IP-Port Pairs Using TLS	3884	265	238	34
IP-Port Pairs Without TLS	5487 (59%)	512 (66%)	3604 (94%)	104 (75%)

The distribution of TCP ports reveals a wide variety of remote access configurations. Three significant peaks can be observed on the commonly used ports 80, 443, and 8080, but the interfaces are also spread across several hundred other ports. This is particularly noticeable for Danfoss StoreView and XWEB EVO, with 88% and 80% of interfaces running on non-standard ports, respectively.

Another finding is that the majority of interfaces are accessible without TLS, regardless of the solution analyzed. This proportion reaches 59% for Danfoss StoreView, 66% for Site Supervisor, 75% for XWEB PRO, and 94% for XWEB EVO.

Without TLS, HTTP traffic is not encrypted. Transmitted information, including credentials when sent directly over HTTP, can therefore be intercepted by an attacker with access to the network traffic. This represents a significant risk for interfaces used to manage technical installations.

Varying Levels of Information Accessible Across Interfaces

Beyond the mere presence of an administrative interface on the Internet, the information visible before authentication varies depending on the product.

Site Supervisor : des informations opérationnelles visibles sans authentification

An examination of a sample of Site Supervisor interfaces reveals a notable characteristic: some installations allow direct access to their supervisory dashboard without prior authentication.

These interfaces provide access to a wide range of information about the operation of supervised equipment, sometimes with a significant level of detail:

• Operating parameters: temperatures: refrigeration circuit pressures, control setpoints, equipment status, and various measurements reported by sensors.
• Alarms and anomalies: active alerts, abnormal operating conditions, and information identifying the affected equipment.
• Measurement history: graphs showing how certain parameters evolve over time, including pressures, utilization rates, and operating status.
• Technical equipment status: some interfaces also expose information related to other building systems, including lighting and the inputs/outputs of supervised systems.

This data provides visibility into the operational status of a facility, without requiring administrative credentials.

On some interfaces, several anomalies are directly flagged by the system, with equipment displayed in red and abnormally high temperatures. Active alarms are also visible through the bell icon in the upper-right corner, which indicates 9 alerts in this case. In the context of the recently reported cyberattacks, these observations are particularly interesting, as they make it possible to identify abnormal conditions and monitor their evolution remotely. However, they do not establish that the observed anomalies are the result of a cyberattack. Equipment failures, maintenance operations, defrost cycles, or technical malfunctions could also explain these conditions.

The exposure is not limited to technical information. Some interfaces allow the supervised facility to be directly identified, notably through its name, retail brand, or logo (blurred in the screenshot below). In several cases, a store floor plan is also accessible, showing the various refrigeration units and their locations, along with measurements and status indicators.

This combination of information makes it possible to link a technical installation to a specific facility, and even to locate the supervised equipment within the building.

Access to the status of certain sensors and equipment may also raise physical security concerns. Information about alarm activation, lighting status, or other technical systems could provide a third party with insights into certain operating conditions at the site. However, the actual implications depend on the nature of the supervised equipment: a technical alarm does not necessarily correspond to an intrusion detection system.

Finally, some interfaces display the number of users connected to the system and the firmware version in the footer. This information can help characterize the administration environment and identify the software generations deployed. However, the session counter does not allow users to be identified or the nature of their activities to be determined.

These observations highlight the risks associated with the direct exposure of industrial supervisory interfaces. Without exploiting a vulnerability or possessing any credentials, a third party can access detailed information about the operation and technical infrastructure of a facility.

However, this visibility does not demonstrate the existence of write access or the ability to modify operating parameters without authentication. The available observations also do not establish whether read-only access is enabled by default or results from configurations specific to the affected installations.

XWEB EVO and XWEB PRO : Authentification interfaces

Unlike the Site Supervisor examples discussed above, the detected XWEB EVO and XWEB PRO interfaces primarily display login pages.

The presence of an authentication form provides an initial barrier between visitors and administrative functions. However, it does not necessarily mean that the access control mechanisms are free from vulnerabilities. This distinction is particularly important for XWEB PRO, as several authentication and code execution vulnerabilities were publicly documented in 2026.

Previously Documented Critical Vulnerabilities

Site Supervisor: Frostbyte10 vulnerabilities

In September 2025, Armis Labs published research titled Frostbyte10, detailing ten vulnerabilities affecting Copeland E2 and E3 controllers.

Depending on the conditions of exploitation, these vulnerabilities could allow unauthorized access, privilege escalation, code execution, or modification of industrial equipment parameters.

Among the documented vulnerabilities are:

• CVE-2025-6519: the presence of an ONEDAY administrator account whose password is generated daily using a predictable mechanism. Users cannot delete or modify this account.
• CVE-2025-52549: predictable password generation for the Linux root account, based on known or obtainable parameters.
• CVE-2025-52550: the absence of cryptographic signatures on update packages, allowing a user with the necessary privileges to install modified firmware.

For the affected devices, firmware versions prior to 2.31F01 are vulnerable. Patches are available starting with this version.

These vulnerabilities illustrate the potential consequences of insufficiently secured authentication or update mechanisms in systems controlling physical processes.

XWEB PRO: Claroty Team82 research

In August 2026, Claroty Team82 published a security analysis of Copeland XWEB PRO controllers, revealing 23 vulnerabilities, including 21 rated as high severity. This research team appears once again, having previously discovered the vulnerabilities affecting Danfoss AK-SM 800A controllers discussed in the first part of this article.

Among the documented vulnerabilities are:

• CVE-2026-25085: an authentication bypass in the Lua application layer, caused by improper handling of a return value.
• CVE-2026-21718: a weakness in the generation of administrative credentials, allowing them to be derived from device parameters and information contained in the firmware.
• CVE-2026-25111: a vulnerability also affecting certain XWEB PRO models, including the XWEB 500B PRO.

The models explicitly covered by the security advisory include the XWEB 300D PRO, XWEB 500D PRO, and XWEB 500B PRO, running firmware versions 1.12.1 and earlier. Copeland has released patches and recommends updating the affected devices.

These vulnerabilities demonstrate that the presence of a login form alone is not sufficient to guarantee the security of an administrative interface, particularly when the authentication mechanisms themselves contain weaknesses.

The Distinct Case of XWEB EVO

XWEB EVO interfaces require an important distinction.

Some generations appear to share application-level characteristics with XWEB PRO, particularly in their client-side code and page structure. However, the vulnerabilities documented by Claroty and the models explicitly listed in the CISA advisory are not, on their own, sufficient to conclude that XWEB EVO interfaces are affected.

The apparent sharing of software components does not prove that the firmware or vulnerable mechanisms are identical. Without a confirmed match with the affected versions, their vulnerability status must therefore remain undetermined.

Firmware Version Analysis: Can Vulnerable Devices Be Identified?

Detecting an exposed administrative interface is not sufficient to determine whether the associated controller is running a vulnerable firmware version. However, several technical characteristics can be used to distinguish between software generations, including JavaScript filenames, HTTP headers, and certain static resources.

Site Supervisor: Identifying Firmware Versions Through JavaScript Files

Site Supervisor pages load JavaScript resources whose filenames contain a characteristic fingerprint of the software build, such as manifest.<hash>.js or index-<hash>.js.

ONYPHE’s analysis identified 34 distinct fingerprints across the interfaces examined. When the firmware version is also displayed in the interface, it becomes possible to establish a correlation between that version and the JavaScript file fingerprint.

This method makes it possible to characterize the different software generations observed, provided that the mapping remains consistent across installations. The main fingerprints identified are as follows:

JavaScript fingerprints	IP	Version
index-e7Q1qikY	75	2.31F01
manifest.55957bea…	57	2.26F02
index-BVxYcbwd	52	2.30F01
index-DbSPsyg4	52	2.32F01
index-XoZeJJk4	51	2.33F01
index-CAxH897j	42	2.30F02
manifest.b567a46c…	41	Non déterminée
manifest.a0b30a90…	39	2.25F01
manifest.99a04334…	36	2.28F02
manifest.a4547745…	33	2.29F02
index-C5ThAbG_	19	2.33F02

Mappings established through the analysis of interfaces identified by ONYPHE. Firmware versions associated with these fingerprints should be considered identifications based on sampling, rather than independent validation of each firmware version.

These eleven fingerprints account for 497 IP addresses in the Site Supervisor sample, representing approximately 90% of the observed installed base.

Among them, several are associated with firmware versions prior to 2.31F01, the version in which the E3 vulnerabilities documented by Armis were patched. These six fingerprints, associated with versions 2.25F01, 2.26F02, 2.28F02, 2.29F02, 2.30F01, and 2.30F02, highlighted in red in the table above, account for 259 IP addresses.

These findings make it possible to identify a significant number of interfaces associated with software generations affected by the Frostbyte10 vulnerabilities. However, they do not allow the vulnerability status of each individual device to be confirmed, particularly without directly verifying its firmware.

XWEB PRO: Identical Resources, but an Undetermined Firmware Version

The 108 IP addresses associated with XWEB PRO display an identical login page in the collected data.

However, an examination of the HTTP responses reveals several distinct Last-Modified and ETag header values. In particular, four resource modification dates were identified, ranging from October 2021 to May 2022.

While this consistency suggests that the interfaces examined use a limited number of web resource variants, it does not establish that the devices are running the same firmware versions.

In particular, the modification date of an HTML file does not necessarily correspond to the firmware release or installation date. An update may retain older static resources, without HTTP metadata providing any indication of changes made to internal components.

Since patches for the XWEB PRO vulnerabilities were released in 2026, the presence of web files dating from 2021 or 2022 could suggest outdated software. However, this interpretation would require verifying whether the patched versions actually replace the affected resources.

At this stage, the available data does not allow us to quantify the proportion of XWEB PRO devices running firmware versions 1.12.1 and earlier.

XWEB EVO: Multiple Interface Generations Identified

XWEB EVO firmware versions cannot be precisely identified from the collected HTTP data.

However, analysis of the HTML content, loaded resources, and HTTP headers makes it possible to distinguish two main families of interfaces: a first, apparently more recent generation, accounting for approximately 1,640 IP addresses, and a second, older generation, representing approximately 320 IP addresses, some of which use the lighttpd/1.4.31 web server.

These differences indicate the coexistence of several software generations, without making it possible to assign specific firmware versions to them. Furthermore, none of the vulnerabilities discussed above explicitly affect XWEB EVO. Therefore, based on currently available public information, even a more detailed analysis of firmware versions would not make it possible to estimate the proportion of devices affected by these CVEs.

Conclusion

This second part of the investigation highlights an exposure footprint that extends beyond Danfoss equipment alone. The expansion of the CERT-FR alert to include XWEB systems prompted an examination of Copeland and Dixell solutions, followed by an extension of the investigation to Site Supervisor, another product range from the group.

Although Site Supervisor is not covered by the current alerts, its analysis reveals a particularly noteworthy exposure: some interfaces allow unauthenticated access to temperatures, pressures, alarms, equipment status, measurement histories, and sometimes even store floor plans, along with information identifying the supervised facilities.

ONYPHE data also reveals several thousand Internet-accessible interfaces, frequently exposed through telecom networks, on non-standard ports, and over unencrypted HTTP connections. The vulnerabilities documented by Armis and Claroty further reinforce these concerns: several hundred Site Supervisor interfaces are associated with firmware versions predating the Frostbyte10 patches, while the vulnerability status of XWEB PRO interfaces remains undetermined.

These observations highlight a security concern that goes beyond vulnerabilities specific to individual manufacturers: the direct exposure of systems capable of monitoring and, under certain conditions, controlling physical processes. Eliminating direct Internet access, securing remote maintenance, and applying security patches therefore remain essential.

Finally, it is important to emphasize that the exposed devices identified and presented in this investigation are not necessarily linked to the October 2026 cyberattacks. While some interfaces display abnormal temperatures or active alarms, these observations alone are not sufficient to establish that a compromise has occurred. No direct link could be established between these devices and the reported attacks.