France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches
France's cyber agency has seen "numerous compromises" of remote refrigeration controllers. Copeland says its XWEB EVO supervisor has reached end of service and will get no more security fixes.
Refrigeration operators face a hard trade-off. Cut the contractor's remote link and lose monitoring, or keep a public address that cannot be patched.
The practical route is a VPN, an encrypted tunnel that keeps the contractor connected without a public address. France's cyber agency CERT-FR says attackers have compromised remote controllers for refrigeration plants and tells operators to take them off the internet. One vendor says a discontinued model has reached end of service and gets no more security fixes.
The units supervise commercial and industrial refrigeration plants from a distance. In its alert CERTFR-2026-ALE-012, CERT-FR says it knows of numerous compromises of Danfoss AK-SM and AK-SC controllers and Copeland and Dixell xweb units.
The scope widened within a day. The alert was first published on 12 October, extended on 13 October with more targeted equipment and updated on 16 October with new recommendations.
CERT-FR has not said how attackers got in. It still asks operators to remove every unit from a public address. That includes Danfoss units with a firmware route and the supported XWEB PRO. It calls exposing a management interface to the internet contrary to good practice.
Copeland admits a vulnerability in a generation of XWEB EVO controllers. Its bulletin of 14 October says that generation is no longer sold and has reached end of life. An in-depth investigation has been opened.
The XWEB EVO "a atteint sa fin de service", meaning it has reached end of service, and gets no more security fixes. The supported platform is XWEB PRO, which Copeland also says should not be exposed to the internet.
A factory reset leaves the unit exposed. It removes the intruder's foothold, CERT-FR says, but the unit stays vulnerable and will certainly be compromised again. Any end-of-life device kept online carries a "très forte probabilité de compromission", a very high probability of compromise. Copeland says the EVO is one.
For Danfoss units, CERT-FR says to restart or reset to factory settings. Then update the firmware, set the security level to Strict and change default passwords. An XWEB EVO has no new patch to apply.
Copeland wants every XWEB EVO off the public internet immediately. That means no port forwarding and no direct public IP address. Then look for suspicious activity from the local network and restore the device if needed.
Going offline has a price. CERT-FR tells operators to check their insurance conditions before cutting the data link to the refrigeration contractor. That link carries the contractor's remote monitoring. A store or cold-storage operator has to weigh that monitoring against a public address that cannot be patched.
The agency offers a stopgap. As an urgent measure, operators can filter incoming traffic to the contractor's own addresses on a firewall. CERT-FR says this should not be treated as a lasting fix.
The durable answer is access through a secure VPN. Dixell France, whose supplement sits in the same PDF, suggests three routes. One is a 4G router with a VPN and a prepaid SIM card, which keeps the XWEB apart from the customer's own network. Another is the VPN server built into a Free, Free Pro or Orange Pro box, at no extra cost and dedicated to the XWEB. The third is a VPN server run by the customer's IT team.
Both models ship with the same factory login. Dixell France's supplement says XWEB PRO and EVO come with the account "Admin" and password "Admin". It puts that in a section on hardening accounts, which also asks for named accounts and expiry dates for outside contractors.
The EVO has a weaker lock than the PRO. The supplement says the EVO offers no configurable password policy. It blocks an account for 5 minutes after 5 wrong entries in 5 minutes. Dixell France adds that no AnyDesk, TeamViewer or similar remote desktop tool should sit on an always-on PC at the site.
Copeland's clean-up starts on the local network. Log in only from there, and take screenshots of the user list, profiles and system settings first because Copeland's support team may need them.
Then lock the accounts. Change every user's password to at least 8 characters with a digit, an upper-case and a lower-case letter. Put the unit on a dedicated network segment, a VLAN, kept apart from office, till and guest Wi-Fi networks.
Next, check what the intruder changed. CERT-FR asks for a full configuration review, including defrost windows. Copeland says to restore settings from a backup, or check setpoints, alarm thresholds and defrost parameters by hand, then trigger a test alarm.
Check the food too. Altered settings can compromise product temperatures, so look at the cabinets. Finally, type the site's public IP address into a phone browser with Wi-Fi off. The XWEB login page should not appear. The check takes a minute and needs no tools.
Copeland tells users to inform its technical support, their own IT or security team and the competent authority. The Dixell France supplement says that authority is ANSSI in France. ANSSI publishes through CERT-FR. The bulletin itself names the US agency CISA, which matters little to a French operator.
Migration is the real bill. Copeland urges EVO owners to move to XWEB PRO, and Dixell France says to contact it to prepare the move. Until then, it says to install the latest software version available for the model.
CERT-FR said on 16 October that attack campaigns are probably still under way, and its page showed no later version on 21 October. The investigation Copeland opened on 14 October is the next source to watch, but its bulletin gives no date for results. Every EVO unit on a public address stays exposed until it sits behind a VPN or is replaced by XWEB PRO behind one.