Nearly 15,000 fridge and cooling controllers still exposed

Following the recent attacks on refrigeration systems across Europe, XINTRA investigated how many refrigeration and cooling systems remain exposed online.

Our search extended beyond the affected vendors and identified nearly 15,000 internet-facing hosts, spanning supermarket refrigeration supervisors, building controls and data centre cooling interfaces.

What we found

• CAREL boss dominated the results, accounting for 10,745 matching hosts, nearly three-quarters of the total.
• France accounted for approximately 29%, with 4,283 matching hosts. Most were identified as CAREL boss, rather than the product families named in the recent attacks.
• 7,937 hosts were labelled by Censys as serving login pages, making management interfaces discoverable from the internet.

These counts indicate exposure, not confirmed vulnerability or compromise. A matching host does not necessarily represent a separate physical controller or supermarket.

Exposure by product

Most of what we found is store and plant supervisors on ordinary broadband and mobile connections, answering on standard HTTPS ports. CAREL's boss supervisor alone makes up nearly three-quarters of the results.

These rows add up to 14,557 of the 14,895 hosts. The other 338 matched other parts of the query and are not broken out by product.

How controller access can disrupt cooling

The initial access method used in the recent attacks remains publicly unconfirmed. However, the reported disruption involved manipulating ordinary refrigeration functions: forcing defrost cycles or changing temperature setpoints.

An attacker who gains sufficient control privileges may be able to disrupt cooling using the controller's built-in functions, without deploying specialised malware.

A possible path from exposure to stock loss is:

1. A management interface is reachable from the internet.
2. An attacker gains access through compromised credentials, an authentication weakness or another route.
3. They force defrost or alter temperature settings.
4. Cooling is interrupted. On some controllers, temperature alarms may also be suppressed during defrost.
5. Without an independent warning and timely intervention, stock warms beyond safe limits.

The outcome depends on the controller configuration, local safeguards and monitoring. An exposed login page alone does not establish that this entire path is possible.

Known vulnerabilities require version checks

Every major product family in our results has a public record of serious flaws, and two have now been attacked. Several of those flaws bypass the login, so on unpatched units there's no password to get past at all.

Security advisories describe authentication weaknesses and other serious vulnerabilities in specific versions of several products represented in our results.

Those advisories can help operators prioritise checks, but a product fingerprint alone does not establish whether a host runs an affected version. Match the exact model and firmware against vendor guidance before drawing conclusions.

Two points stand out. CAREL boss, by far the largest group in our results, has had a 9.9 flaw in its boss mini variant. And both Danfoss and Copeland shipped hidden or predictable daily passwords, so a changed default password does not close every door.

What operators should test

Start with the consequence you need to prevent; if someone changed your refrigeration controls tonight, would anyone notice before cooling loss became stock loss?

Test in a lab, on spare equipment or in a controlled environment agreed with your refrigeration engineer.

If you can only test one thing this quarter, start with the first row. Spoiled stock is what the French attacks caused, and an independent temperature alarm is the cheapest control to check.

For immediate action

Start with three questions: who can reach these controls, what can they change, and how quickly would an independent alarm pick up the result?

• Find your own exposure. Search Censys or Shodan for your public IP ranges and look for refrigeration controller login pages.
• Ask your refrigeration contractors how they connect. Remote access they set up and maintain is often outside your own asset list.
• Take management interfaces off the internet. Put remote access behind a VPN or remote access gateway with multi-factor authentication.
• Change default credentials on every controller, including ones only contractors use.
• Check what happens to alarms during defrost. If the controller suppresses them, make sure something else is watching.
• Add independent temperature monitoring that does not rely on the controller being honest.
• Check defrost schedules and setpoints against a known-good record, so you'd spot a change someone else made.

Appendix

How we collected this information, and the Censys queries used

We searched Censys for the web management interfaces of each affected product family, ran them on 10 November, and filtered out hosts that were not real devices as much as possible.

1. Built one Censys query that covers every vendor family. It matches mostly on Censys's own hardware and product fingerprints.
2. Removed likely honeypots by keeping only hosts with three or fewer exposed services. Honeypots tend to answer on many ports at once. The trade-off: this can also drop a real controller sitting behind a router with many open ports. The query matched 19,021 hosts before this filter and 14,895 after, so it removed 4,126.
3. Counted host records only, so a system that also shows up as a website or certificate isn't counted twice. We also dropped search terms that pulled in unrelated systems (see below).

These counts are a snapshot. The time between taking the screenshots and running other scans means the exact number of assets may increase or decrease.

The main query, as we ran it on 10 November:

(
  host.services.hardware: (vendor: "carel" and product: {"boss", "pcoweb", "plantvisor"})
  or host.services.hardware: (vendor: "copeland" and product: {"xweb", "site_supervisor", "e2"})
  or host.services.hardware: (vendor: "danfoss" and product: {"ak-sm_800a", "mcx"})
  or host.services.hardware: (vendor: "emerson" and product: "dixell_ipro")
  or host.services.hardware: (vendor: "trane" and product: "tracer")
  or host.services.hardware: (vendor: "stulz" and product: {"wib", "wib_8000"})
  or host.services.hardware: (vendor: {"vertiv", "liebert"} and product: "intellislot_web_card")
  or host.services.software.vendor: "eliwell"
  or host.services.endpoints.http.html_title: {"XWEB", "pCOWeb", "Site Supervisor", "Tracer SC", "Televis"}
  or host.services.endpoints.http.body: "Resource Data Management"
)
and host.service_count <= 3

What we searched for first, and what we dropped

Our first query cast a wide net: product names anywhere in a page, Censys's broad vendor match, and a hash of one specific Danfoss page. It found 15,998 hosts, but checking the results showed many weren't refrigeration or cooling kit. So we rebuilt the query around Censys's own product fingerprints.

The first query, with the Danfoss hash blacked out:

(
  host.services.endpoints.http.html_title: {"XWEB", "Site Supervisor", "pCOWeb", "PlantVisor", "Televis", "Tracer SC", "Liebert", "iCOM", "Uniflair", "InRow", "STULZ", "CMC III"}
  or host.services.endpoints.http.body: {"Dixell", "XWEB", "pCOWeb", "PlantVisorPRO", "CAREL", "Eliwell", "Televis", "Resource Data Management", "Uniflair", "STULZ", "Rittal", "Hussmann", "Hillphoenix", "Epta", "Arneg"}
  or vendor: {"Copeland", "Dixell", "CAREL", "Eliwell", "Trane", "Vertiv", "Liebert", "Stulz", "Rittal"}
  or host.services.endpoints.http.body_hash_sha1 = "██████████ withheld ██████████"
)
and (host.ip: * and host.service_count <= 3)

Why we've blacked out the Danfoss hash. It matches one specific page version served by Danfoss AK-SM 800A system managers, the product line hit in France. Based on several factors, we assess that the hosts it returns may still be vulnerable. Censys's public AK-SM 800A fingerprint finds more hosts, but it doesn't single out that version. The hash does, so publishing it would hand anyone a shortlist of likely targets.