Secure data centers require remediation and mitigation of data center asset and infrastructure exposures. Claroty Team82’s latest research report dives into the riskiest data center exposures, and how...

Track all CPS vulnerabilities disclosed by Team82, the industry’s best cybersecurity vulnerability and threat research team. Team82 finds software and firmware vulnerabilities before threat actors can exploit them.

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclos...

Team82 researched the attack surface of the Copeland XWEB Pro platform to assess its resilience against network-based attacks. Our analysis uncovered a total of 23 vulnerabilities, 21 of which are hig...

Claroty Team82 has uncovered 23 vulnerabilities in Copeland’s XWEB Pro supervisory controllers, widely used to manage commercial refrigeration in supermarkets, warehouses, and hospitals. Of these, 21 are rated high severity, and together they allow an unauthenticated attacker to gain full root-level control of the device over the network. Commercial cooling systems rely on a layered setup. A supervisory controller sits at the top, connected to the internet. In contrast, field controllers below it manage individual units, such as compressors and fans, via a serial connection. The Copeland XWEB300D and XWEB500D PRO controllers are central to this setup, tracking temperature logs required for food safety and health regulations. Commercial refrigeration control system managing multiple units (Source: Team 82) One flaw, tracked as CVE 2026 25085, stems from a coding logic error. When a user submits an unrecognized login type, the system should reject it. Instead, it returns an empty data structure that the software mistakenly treats as valid. This allowed attackers to bypass login checks entirely and access restricted administrative functions without credentials. A second flaw, CVE 2026 21718, is arguably more dangerous. The device generates its administrator SSH and web passwords using only the current date, the device’s MAC address, and secret keys hidden in the firmware. An XWEB500D PRO controller unit (Source: Team 82) Since the date is public and the MAC address is easy to retrieve, an attacker can calculate the exact daily password offline and log in as an administrator. After bypassing authentication, researchers found 19 separate command injection flaws across various device functions, including firmware updates and network settings. These allow attackers to insert hidden system commands into normal-looking data, granting them complete root access to the controller. To demonstrate real-world impact, researchers built a working mini-refrigerator connected to an XWEB controller and an XR60CX field unit. Using a custom Python tool, they demonstrated how to set the display to any arbitrary temperature between -50 and 110 degrees Celsius. An HTTP request that exploits the authentication bypass to access a device-protected endpoint (Source: Team 82) More alarmingly, they showed an attack in which the display kept showing the correct temperature while the cooling fans were silently switched off in the background. The refrigerator slowly warmed, spoiling its contents, with no visible warning on the screen. Claroty reported these issues to Copeland , which released firmware version 1.13 to patch all 23 vulnerabilities. Facilities using XWEB Pro controllers should update immediately, since exploitation requires no valid credentials and can be carried out remotely over the internet. This research highlights a growing risk in operational technology: software bugs in industrial controllers can directly cause physical damage, from spoiled groceries to ruined medical supplies. Experts recommend removing these controllers from direct internet exposure, segmenting refrigeration networks from other systems, and applying vendor patches promptly to prevent similar silent sabotage attacks.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post Hackers Can Turn Off Refrigeration While the Temperature Display Still Looks Normal appeared first on Cyber Security News .

コープランド社の商用冷蔵コントローラー「XWEB Pro」に新たに23件の脆弱性が明らかになりました。認証バイパスや、予測可能な認証情報生成の欠陥が含まれており、認証されていない遠隔攻撃者がルート権限でのコード実行を獲得できる恐れがあります。 この問題は、Claroty社の研究部門Team82によって公表されたもので

Secure data centers require remediation and mitigation of data center asset and infrastructure exposures. Claroty Team82’s latest research report dives into the riskiest data center exposures, and how...

Claroty Team82 researchers used Anthropic’s Claude Opus 4.6 AI model to uncover vulnerabilities in a popular video intercom platform manufactured by Zenitel. Team82 had already manually researched and disclosed five vulnerabilities in the TCIV-3+ model, a rugged IP-based video intercom that is deployed in many high-s...

Team82 entdeckt Schwachstellen in USP-Systemen und HLK-Anlagen

Iran-affiliated actors linked to the Islamic Revolutionary Guard Corps (IRGC) and The Ministry of Intelligence of the Islamic Republic of Iran (MOIS) claimed to have hijacked emergency alerts and anno...

Team82 uncovered two critical vulnerabilities in Vertiv’s Liebert IS-UNITY-DP network cards, both assessed a CVSSv3 score of 9.8. These cards are a network interface for Vertiv’s line of uninterruptib...

Claroty's Team82 finds authentication bypass, RCE flaws in Vertiv UPS management cards that could disrupt data center operations.

The companies are addressing the risks with updates, according to Team82 of cybersecurity company Claroty, which found and shared the vulnerabilities with the companies.

Claroty Team82 researchers used Anthropic’s Claude Opus 4.6 AI model to uncover vulnerabilities in a popular video intercom platform manufactured by Zenitel. Team82 had already manually researched and...

The Reddit post links to a research article by Claroty’s Team82 demonstrating how large language models (LLMs) can be used in vulnerability research. The referenced work explores hands-free approaches to identifying security flaws. The post itself only shares the external URL without additional details.

The Mythos We Have At Home: A Patch-Diffing Pipeline for N-Day Generation https://www.originhq.com/research/patch-diffing-pipeline Hands Free: What LLM Driven Vulnerability Research Looks Like https://claroty.com/team82/research/hands-free-what-llm-driven-vulnerability-research-looks-like The Mythos Moment: What It Changes, What It Doesn’t, and What We Do Next https://www.netskope.com/blog/the-mythos-moment-what-it-changes-what-it-doesnt-and-what-we-do-next Canada has access to Anthropic’s powerful Mythos AI model, minister says https://globalnews.ca/news/11887018/ai-anthropic-mythos-project-glasswing-canada/

Claroty Team82 researchers used Anthropic’s Claude Opus 4.6 AI model to uncover vulnerabilities in a popular video intercom platform manufactured by Zenitel. Team82 had already manually researched and disclosed five vulnerabilities in the TCIV-3+ model, a rugged IP-based video intercom that is deployed in many high-s...

Claroty Team82 researchers used Anthropic’s Claude Opus 4.6 AI model to uncover vulnerabilities in a popular video intercom platform manufactured by Zenitel. Team82 had already manually researched and...