Home / Technology / Supermarket Refrigeration Systems Hacked Daily!
Supermarket Refrigeration Systems Hacked Daily!
21 Oct
Summary
- Thousands of Danfoss controllers found online, vulnerable to remote attack.
- A hidden daily code could bypass normal administrator password protection.
- Email flaws allow potential operating system command execution.
Thousands of Danfoss refrigeration management systems are potentially exposed to remote cyberattacks following the discovery of significant authentication and software vulnerabilities by security researchers. The AK-SM 800A controller, commonly used in supermarkets and cold storage, was found to have security weaknesses.
One critical flaw, CVE-2025-41450, involves an undocumented daily generated access code that could bypass standard administrator password protection. Researchers were able to reconstruct the algorithm for this code, potentially allowing unauthorized access to system configurations.
Another vulnerability, CVE-2025-41451, permits command injection through the controller's email configuration. Malicious input during email setup could lead to the execution of operating system commands, a risk amplified when combined with the password bypass flaw.
Furthermore, CVE-2025-41452 affects the web server configuration, allowing authenticated users to modify server settings. This could disrupt the management interface, potentially leading to denial-of-service attacks. Danfoss has released firmware version R4.3.1 to address these issues.
