Product Security Resources
Copeland supports coordinated vulnerability disclosure through a defined process for reporting potential cybersecurity vulnerabilities, strengthening product security and reducing potential risk to customers.
Report a Potential Product Vulnerability
In order to put you in direct contact with the appropriate Copeland Product Security Incident Response Team, this short form will gather essential information about the issue you would like to report.
Copeland statement on recent cybersecurity incidents affecting refrigeration systems in France
We are aware of a cybersecurity vulnerability affecting a discontinued, end-of-life generation of supervisory controllers. Protecting our customers' operations remains a top priority, and we are working with impacted customers to help mitigate risk. We will continue to support customers through supported products, current software and cybersecurity best practices.
Supervisory controllers are at the heart of refrigeration and HVAC operations. While Copeland builds security into its products and provides updates for supported platforms, cybersecurity is a shared responsibility. How systems are installed, accessed, maintained, and monitored is just as important as the technology itself.
Recommended Practices
-
Keep controllers off the public internet. Never use port forwarding or public IP addresses. Use a secure VPN for remote access.
-
Keep software current. Apply the latest supported software and firmware updates and replace end-of-life equipment when possible.
-
Manage user accounts securely. Use strong passwords, unique accounts and regularly review user access.
-
Secure the network and equipment. Segment controllers from other networks, enable HTTPS and restrict physical access.
-
Back up and monitor. Maintain current backups and regularly review logs for unexpected activity.
-
Respond quickly to concerns. Investigate suspicious activity promptly and engage support if a security incident is suspected.
Following these practices can significantly reduce cybersecurity risk and help ensure reliable system operation. Copeland remains committed to supporting customers with secure products, software updates and guidance for protecting connected installations.
Contact
Copeland Technical Support: ColdChain.TechnicalServices@Copeland.com
Product Vulnerability Disclosure Policy
Product Vulnerability Management
Copeland is committed to protecting the security, reliability, and resilience of our products, and digital platforms. We maintain processes to receive, assess, prioritize, and address potential cybersecurity vulnerabilities, considering applicable regulatory requirements, product risk, and relevant industry guidance.
We welcome responsible reports of potential cybersecurity vulnerabilities from customers, researchers, partners, suppliers, and vulnerability coordination organizations. If you believe you have identified a security issue involving a Copeland product or digital service, please report it through Copeland’s Report a Potential Product Vulnerability webpage.
Scope
This policy applies to potential cybersecurity vulnerabilities affecting Copeland products, software, firmware, cloud-connected services, mobile applications, APIs, web portals, and related digital components.
Out of Scope
This policy is intended for cybersecurity vulnerability reporting only. For customer support, warranty requests, privacy inquiries, or general product quality issues, and other non-security matters are outside the scope of this policy and should be directed to the appropriate Copeland support channel.
What to Include in Your Report
Please include enough detail for Copeland to review and validate the concern, such as:
- Affected product, service, application, or component
- Product model, firmware version, software version, build number, or serial number, if available
- Brand or product family
- General description of the issue
- Your contact information, unless you prefer to report anonymously
Do not submit passwords, cryptographic keys, personal data, customer data, or other sensitive information through an unsecured channel.
Responsible Reporting Guidelines
When submitting a vulnerability report, we ask that you:
- Allow Copeland time to investigate and address the issue before publicly sharing technical details.
- Avoid testing that could disrupt products, services, customer environments, or normal operations.
- Avoid accessing, changing, downloading, or sharing data that is not yours.
- Limit testing to what is necessary to demonstrate the potential vulnerability.
- Understand that Copeland does not provide compensation for vulnerability submissions.
What to Expect
Copeland will make reasonable efforts to:
- Acknowledge receipt of a vulnerability report in a timely manner.
- Review and triage the report to determine whether it is valid and in scope.
- Request additional information when needed to assess the issue.
- Prioritize remediation based on severity, exploitability, exposure, safety impact, customer impact, product lifecycle status, and available mitigations.
- Coordinate disclosure timing when appropriate.
Copeland does not guarantee that every report will result in a product change, security advisory, CVE, public recognition, or direct response beyond acknowledgment and triage.
Coordinated Disclosure
Copeland supports coordinated vulnerability disclosure. We require submitters to keep vulnerability details confidential and avoid public disclosure until Copeland has had a reasonable opportunity to investigate, assess, and address the reported vulnerability.
Where appropriate, Copeland may publish a security advisory that includes affected products, affected versions, severity, CVE identifiers, mitigation steps, remediation steps, update instructions, and customer guidance.
Safe Harbor
Copeland supports good-faith security research conducted in accordance with this policy and applicable law. Copeland does not intend to pursue legal action against individuals who act in good faith, avoid causing harm, and provide Copeland a reasonable opportunity to investigate and address the reported vulnerability. Activities that intentionally harm Copeland systems, products, customers, users, or third parties are not permitted.
Anonymous Reporting
Copeland accepts anonymous vulnerability reports. However, anonymous reporting may limit our ability to request clarification, validate the issue, coordinate remediation, or provide updates.
Policy Updates
Copeland may update this policy from time to time to reflect changes in our products, services, reporting process, or applicable requirements.
Product Security Advisories
| CVE # | Remediation/ Mitigation | Description | Products & Affected Versions | Last Updated | PDF Advisory | CSAF 2.0 |
|---|---|---|---|---|---|---|
CVE-2026-25085 | Upgrade to firmware version 1.15.1 or later. See PDF Advisory and CSAF for detailed remediation guidance. | Multiple vulnerabilities affecting authentication, access control, remote code execution, file access, and system availability. | XWEB 300D PRO, XWEB 500D PRO, XWEB 500B PRO | Feb. 26, 2026 | ||
CVE-2025-6519 | Upgrade to firmware version 2.31F01 or later. See PDF Advisory and CSAF for detailed remediation guidance. | Multiple vulnerabilities affecting authentication, privilege management, firmware integrity, confidentiality, and availability. | E3 Site Supervisor Control | Sept. 02, 2025 | ||
See PDF Advisory and CSAF for remediation and mitigation guidance. | Unauthenticated file operations vulnerability. | E2 Facility Management Systems | Sept. 02, 2025 |
Government Information Request
This form is intended for government officials or authorized representatives requesting information about Copeland products, solutions, or business operations.
This short form helps Copeland route your request to the appropriate internal team for review and response.
Note: Do not use this form to submit confidential, classified, export-controlled, or legally privileged information. This form is not intended for service of legal process, subpoenas, or formal legal notices, which should be submitted in accordance with applicable legal requirements.
