Researchers find 2,765 exposed Danfoss refrigeration systems and three flaws

Researchers at Claroty’s Team82 identified 2,765 publicly accessible Danfoss refrigeration systems, raising concern that vulnerable controllers could be targeted remotely. The findings concern the AK-SM 800A, used to monitor and configure refrigeration equipment in supermarkets, warehouses and cold-storage facilities.

Team82 reported three vulnerabilities. CVE-2025-41450 involves an undocumented authentication method that uses a daily generated access code and could allow someone to bypass the administrator password. Researchers reconstructed the code-generation algorithm by examining the controller’s firmware and authentication routines.

CVE-2025-41451 is a command-injection flaw in the email configuration function. A password entered there could be included in an operating-system command without adequate sanitization, potentially enabling remote code execution after authentication.

CVE-2025-41452 affects the controller’s externally accessible Nginx web-server configuration. An authenticated function could replace a configuration file and reload the server. Researchers also found that requests to a maliciously configured route could crash the sm_app process and disrupt the management interface. They did not establish that every such attack would stop refrigeration equipment.

Claroty privately reported the vulnerabilities to Danfoss through coordinated disclosure. Danfoss released firmware version R4.3.1 to address them. The source advises operators of affected AK-SM 800A controllers to upgrade to R4.3.1 or later and restrict administrative interfaces to trusted management networks or protected VPN connections.