Ing. Calogero Bono
On November 13, 2026, Italy's National Cybersecurity Agency published alert AL06/261113/CSIRT-ITA on Dixell XWEB EVO products. It found 13 serious vulnerabilities, 8 critical and 5 high, in systems that supervise commercial refrigeration and HVAC plants. All versions are affected, and the manufacturer will not release fixes because the product has reached end of support. For those who have them in a shop or warehouse, the only way forward is to isolate them and plan their replacement.
A few terms before we get into the facts. HVAC stands for heating, ventilation and air conditioning. EOL (End-of-Life) is the end of support, after which the manufacturer no longer releases updates. Remote Code Execution lets an attacker run code on the system remotely. Authentication Bypass means getting past the login. OT VLAN is a separate virtual network dedicated to industrial equipment.
What did ACN report about Dixell XWEB EVO?
According to the ACN alert, the flaws could allow a remote malicious user to bypass authentication, change configuration parameters, compromise service availability or run arbitrary code.
The types listed are Remote Code Execution, Authentication Bypass, Tampering and Denial of Service. The products involved are supervision, monitoring and control systems for commercial refrigeration.
Why will there be no update?
The vendor has declared End-of-Life status for XWEB EVO, all versions. As a result, it will not release security updates.
ACN therefore recommends evaluating migration to currently supported solutions. Among the alert's references there is also a Copeland product bulletin dated March 2026. It is not the first time a product at end of life has been left without fixes, as in the case of Apache Axis 1.x.
What kind of flaws are there in detail?
ACN points to 14 references, mostly VulnCheck advisories. The titles describe the overall picture.
- Command injection in various components, including api.lua, backup.lua, devices.lua and xwconsole.cgi.
- Injection before authentication, through the username and password fields.
- Authentication bypass and unauthenticated writing of the configuration.
- Predictable passwords or passwords embedded in the firmware for administrator and root.
The alert notes that flaws tied to credentials built into the firmware or to predictable authentication cannot be fixed just by changing passwords.
How to reduce the risk until you replace the devices?
ACN lists mitigation measures to apply in the meantime.
- Inventory all XWEB EVO devices, with model, firmware, location and access method.
- Remove direct exposure to the Internet, checking port forwarding, NAT and public IPs.
- Isolate the controllers in OT VLANs with ACL rules and restrictive firewalls.
- Limit management to authorized workstations, with encrypted VPN, MFA and jump hosts.
- If needed, use a reverse proxy with strong authentication, for example mTLS.
- Harden the devices and monitor traffic with IDS or NDR systems.
After hardening, the agency asks you to check for unknown accounts and unauthorized changes, in particular to alarm thresholds and defrost cycles.
Limits to know
The alert does not say whether the vulnerabilities are already being exploited in the wild, nor does it list CVE codes in the text, only links to the advisories. It does not indicate replacement models or the timing of the phase-out. The technical detail of each flaw is in the linked advisories, which we have not checked one by one.
What changes for those working in digital
Anyone who runs shops, restaurants or cold-chain logistics needs to know whether they have these controllers, which are often installed by third parties and then forgotten. Ask your installer or maintenance provider. If the web interface can be reached from the Internet, that is the first thing to close. For companies that entrust servers and networks to a provider, as with managed hosting and servers, it is also worth adding these OT devices to the inventory and to the access rules.
Our take
This case shows the hidden cost of industrial devices. A refrigeration controller can last for years, but the software that protects it has an expiry date. Here the flaws include credentials built into the firmware, a design defect that no password change can fix. ACN's mitigations are sensible, but they are a stopgap. Anyone buying connected plants should ask in writing how long updates will keep coming.
Frequently asked questions
Is there a patch for Dixell XWEB EVO?
No. The vendor has declared end of support and will not release updates. ACN recommends evaluating migration to supported products.
Which versions are affected?
All versions of Dixell XWEB EVO. The alert does not list any excluded versions.
What is at risk for a refrigeration plant?
According to ACN, a remote attacker could bypass the login, change parameters, block the service or run code. The alert also points to attention to alarm thresholds and defrost cycles.
Is changing the password enough?
No. ACN warns that flaws tied to credentials in the firmware or to predictable authentication cannot be fixed by changing passwords alone.
What should I do first?
Inventory the devices and make sure none of them can be reached from the Internet. Then isolate them on a dedicated network and restrict access with VPN and MFA.
What to check before replacing the controllers
Replacement takes time and budget, so in the meantime what matters is how you organize yourself. Here are three things to follow in the coming weeks.
- Ask the manufacturer or installer for a migration plan with timelines and supported models.
- Read the VulnCheck advisories linked by ACN to understand which flaws affect your devices.
- Check access logs and alarm configurations for changes you do not recognize.
