Critical flaws in Danfoss refrigeration controllers expose thousands to remote attacks

Critical vulnerabilities in Danfoss refrigeration controllers

Security researchers at Claroty’s Team82 uncovered three critical vulnerabilities in Danfoss AK-SM 800A refrigeration controllers, which could allow attackers to bypass authentication, execute remote commands, or cause denial of service. The flaws were disclosed through coordinated reporting to Danfoss.

According to TechRadar, one of the vulnerabilities, tracked as CVE-2025-41450, involves an undocumented authentication mechanism that uses a daily generated access code. Attackers could reconstruct this algorithm by analyzing the controller’s firmware, effectively bypassing the administrator password.

A second vulnerability, CVE-2025-41451, enables command injection through the controller’s email configuration. This could allow remote code execution after authentication. The third flaw, CVE-2025-41452, affects the controller’s Nginx web server configuration and could lead to denial of service if exploited.

Thousands of systems exposed to the internet

Using internet scanning tool Censys, Claroty’s Team82 identified 2,765 Danfoss AK-SM 800A controllers publicly accessible via the internet. These controllers are used to manage refrigeration equipment in supermarkets, warehouses, and cold storage facilities, providing centralized monitoring for temperature settings, alarms, and notifications.

The exposure of these systems highlights the broader risk of internet-connected operational technology (OT) devices, which may lack proper security configurations or regular updates.

Danfoss releases firmware update

Danfoss responded to the vulnerabilities by releasing firmware version R4.3.1, which addresses all three critical flaws. Operators of affected controllers are urged to upgrade immediately to mitigate risks.

In addition to applying the update, researchers recommend restricting access to the controllers’ administrative interfaces. This can be achieved by limiting connections to trusted networks or using protected VPN connections to prevent unauthorized access.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This disclosure is a stark reminder that industrial control systems—even those managing seemingly mundane infrastructure like refrigeration—are increasingly visible to attackers. The flaws in the AK-SM 800A are not just technical oversights; they reflect a pattern of underestimating the attack surface of devices exposed to the public internet. For founders and operators, this is a lesson in proactive security: firmware must be treatable as software, with regular updates, vulnerability scanning, and strict access controls. The fact that thousands of these controllers were publicly accessible suggests many operators may not even realize their systems are exposed. This isn’t just a Danfoss problem—it’s a systemic issue for industries relying on legacy or embedded systems without modern security practices.

Key takeaways

• Operators of Danfoss AK-SM 800A controllers should prioritize upgrading to firmware version R4.3.1 to close critical vulnerabilities.
• Restricting access to administrative interfaces—via VPNs or trusted networks—can significantly reduce exposure to remote attacks.
• Industrial control systems, even in non-critical sectors, require the same security rigor as IT infrastructure: regular patching, monitoring, and segmentation.
• The discovery of 2,765 publicly accessible controllers highlights the risks of internet-exposed operational technology (OT) devices.
• Coordinated disclosure, as used by Claroty’s Team82, underscores the value of responsible reporting in mitigating large-scale security risks.

FAQ

What are the specific vulnerabilities in the Danfoss AK-SM 800A controllers?

The three vulnerabilities are CVE-2025-41450 (authentication bypass via a daily generated access code), CVE-2025-41451 (command injection through email configuration), and CVE-2025-41452 (denial of service via Nginx web server exploitation).

How many Danfoss controllers were publicly accessible?

Claroty’s Team82 used Censys to identify 2,765 Danfoss AK-SM 800A refrigeration controllers that were publicly accessible via the internet.

What should operators do to secure their systems?

Operators should upgrade to firmware version R4.3.1, restrict access to administrative interfaces to trusted networks or VPNs, and ensure regular security monitoring of their systems.

Related on Lazyfounder

• More technology news