Danfoss Patches High-Severity Vulnerability Exposing 4,980 Refrigeration Systems

Key Takeaways

• A high-severity vulnerability in Danfoss refrigeration systems, CVE-2025-41450, allowed unauthorized access and disruption.
• The flaw, impacting AK-SM 8xxA devices, could bypass administrator passwords using a date-based authentication code.
• Approximately 4,980 internet-facing Danfoss hosts have been identified, with over half located in France.
• Danfoss has released firmware updates (R4.2 and R4.3.1) to address this and other related vulnerabilities.

Danfoss Refrigeration Systems Exposed Amidst Cyberattack Aftermath

Recent analyses reveal thousands of Danfoss refrigeration systems are accessible via the internet, with France accounting for the majority of these exposed devices. This comes in the wake of a cyberattack that reportedly disrupted supermarket refrigeration across France, causing significant spoilage of chilled and frozen goods.

According to an update from International Cyber Digest on October 13, 2026, a Shodan search for Danfoss web pages identified 4,980 internet-facing hosts. Of these, a substantial 2,911 are located in France, representing roughly 58% of the total. South Africa follows with 517 exposed systems. While these figures highlight widespread exposure, they do not confirm that every listed host has been compromised.

Further geographical breakdown places Germany third with 171 results, followed by Portugal (158), and the United States (141). Other countries with significant numbers include Poland, Belgium, Sweden, Spain, and the Netherlands. International Cyber Digest estimates that approximately 80% of the matching hosts are situated in Europe, as detailed in their post: https://t.co/ka1AzkNDBB pic.twitter.com/ogUwrTqlWi

Details of the Exposure and Attacks

The Shodan query specifically identifies web content referencing Danfoss, rather than definitively proving each result corresponds to a vulnerable refrigeration controller. A separate, more refined search yielded 4,551 results. Neither search provides specific firmware versions, confirms successful attacks against individual systems, nor indicates how many supermarkets each controller manages.

The updated exposure data follows a series of cyberattacks that occurred between October 11 and October 12. Reports from French supermarkets described attackers remotely activating defrost cycles, leading to widespread food spoilage. Earlier coverage by Cybersecurity News highlighted instances where temperatures in affected refrigerators reportedly soared to 50°C, though these temperature readings should not be generalized across all impacted stores.

France’s national cybersecurity agency, CERT-FR, confirmed multiple compromises involving Danfoss AK-SM and AK-SC devices in an October 12 alert. The agency advised operators to either disconnect these systems or implement stringent access filtering.

Danfoss has communicated to news outlets that the affected refrigeration management systems were operating on outdated firmware. The company reiterated its guidance to update supported equipment and replace older, unsupported systems.

Vulnerability Details and Patches

International Cyber Digest also mentioned a claim that affected systems used a default username of admin and a password that changed daily to the current date. However, published technical research provides a more nuanced explanation for unauthorized access.

Claroty’s Team82 discovered a hidden, date-based authentication bypass in the Danfoss AK-SM 800A platform. This flaw, designated CVE-2025-41450, allowed an attacker to generate a valid daily authentication code based on the controller’s current date, thereby gaining an administrative session without needing the configured administrator password. This mechanism differs from a simple daily password change to the date.

It remains unconfirmed whether this specific vulnerability was exploited in the recent supermarket attacks. CISA’s advisory identifies affected AK-SM 8xxA versions as those predating R4.2, which introduced the fix for this authentication weakness.

The CISA advisory also addresses two other vulnerabilities: CVE-2025-41451, a command injection flaw within email alert settings, and CVE-2025-41452, a weakness in the web server configuration. Both of these issues affect versions prior to R4.3.1.

Team82 detailed that the command injection vulnerability (CVE-2025-41451) could enable remote code execution post-authentication. The web server configuration weakness (CVE-2025-41452) might allow an authenticated attacker to manipulate web traffic handling or disrupt the management interface. These findings illustrate potential attack vectors but do not provide a definitive account of the French incident.

The AK-SM 800A systems are critical, managing multiple refrigeration units through a single web interface, allowing operators to control temperature, schedules, alarms, and user access. Their central role makes exposed management access particularly dangerous, as unauthorized changes can directly impact physical cooling operations, leading to significant financial losses and operational disruptions.

What You Should Do

• Isolate and Disconnect: If compromise is suspected, immediately restrict network access to service providers and consider disconnecting affected systems.
• Apply Patches: Ensure all Danfoss AK-SM 8xxA systems are updated to at least R4.2 (for CVE-2025-41450) and R4.3.1 (for CVE-2025-41451 and CVE-2025-41452).
• Factory Reset and Reconfigure: After patching, perform a factory reset, change all default and existing passwords and secrets, and fully reconfigure the system.
• Enhance Network Segmentation: Remove direct internet exposure for control systems. Separate operational technology (OT) networks from corporate IT networks.
• Secure Remote Access: Implement protected remote access solutions, such as VPNs with multi-factor authentication, for any necessary external management.
• Monitor and Audit: Continuously monitor system logs for unusual activity and audit user accounts regularly.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.