Security researchers have disclosed three vulnerabilities in Danfoss refrigeration controllers that could let an attacker take remote control of supermarket cooling systems, including one flaw built around a hidden daily password scheme and another that allows command injection after login. The Claroty Team82 research team found the bugs in the Danfoss AK-SM 8xxA controller family, with the AK-SM 800A named specifically, and identified 2,765 publicly reachable systems during their scan of the internet, according to TechRadar’s computing security coverage. Danfoss has shipped a firmware fix, but the scale of the exposure is why this is leading tech headlines on October 20, 2026.
The three flaws are tracked as CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452. Together they describe a chain that starts with an authentication bypass and ends with the ability to run operating-system commands on a device that, in the real world, is bolted to the back of a supermarket’s walk-in freezer or deli case. That combination, a weak front door and a way to execute commands once inside, is the exact pattern security teams dread in operational technology, because it turns a refrigeration controller into a foothold on an otherwise isolated network.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: Danfoss Controller Flaws Come to Light
Danfoss AK-SM controllers are the brains behind supermarket refrigeration racks: they manage compressors, defrost cycles, alarms, and temperature logging for the cases that keep meat, dairy, and frozen goods at safe temperatures. The AK-SM 8xxA family, and specifically the AK-SM 800A model named in the disclosure, sits at the center of this latest research. Claroty Team82, the industrial-security research arm of OT security vendor Claroty, found that the controller’s authentication system and its email-notification feature both had serious design flaws that an attacker could chain together to gain administrative access and then execute arbitrary commands.
The disclosure lands in the middle of a period of heavy scrutiny for supermarket refrigeration security more broadly. Reports of a cyberattack that triggered unwanted defrost cycles across hundreds of French supermarkets have already drawn attention to how exposed these systems can be, a story covered in depth after vendors were flagged and again as French authorities opened an investigation. The Danfoss vulnerability disclosure is a separate, vendor-specific finding, but it lands on an industry already primed to ask how many refrigeration controllers sit exposed on the open internet.
CVE-2025-41450: The “Code-of-the-Day” Password Problem
The first and most unusual of the three bugs, CVE-2025-41450, centers on an undocumented authentication-bypass mechanism that Team82 refers to as a “code-of-the-day” scheme. Rather than relying solely on a password set by the store’s technicians, the controller also generated an administrative password algorithmically from the device’s current date. Anyone who understood the generation logic, researchers included, could compute that day’s password and log in with administrative rights without ever knowing the real, configured credential.
That kind of hidden backdoor mechanism is a familiar shape in industrial-control-system security. Maintenance and support teams often want a guaranteed way into a device even if the on-site password is lost, so vendors build in secondary access paths. The problem, as researchers consistently point out across the OT sector, is that an undocumented mechanism based on a predictable input like the date is not a safeguard, it is a skeleton key that works identically on every unit of that model, anywhere in the world, on any given day.
CVE-2025-41451: Command Injection via Email Configuration
The second vulnerability, CVE-2025-41451, is a command-injection flaw located in the controller’s email-configuration functionality, the feature that lets a technician set up alert notifications for temperature excursions or equipment faults. According to the disclosure, insufficiently sanitized input in that configuration workflow could let an authenticated user run operating-system commands on the underlying device. In practice, that means the email-alert setup screen, something designed purely to forward notifications, could be turned into a launchpad for arbitrary code execution once an attacker had already cleared the authentication hurdle.
The sequence matters here. CVE-2025-41450 gets an attacker past the login screen without the real password, and CVE-2025-41451 gives that now-authenticated attacker a path to full command execution on the host operating system. Chained together, the two flaws describe a complete takeover path, from an internet-facing login page to shell-level control, with no social engineering, phishing, or malware delivery required.
CVE-2025-41452: A Third Flaw in System Configuration Controls
A third vulnerability, CVE-2025-41452, was also reported for the AK-SM 8xxA family, described as an issue involving external control of system configuration. Public reporting on this third flaw is thinner than on the first two, but its inclusion alongside an authentication bypass and a command-injection bug points to a broader pattern: the controller’s configuration layer, the set of settings an administrator is meant to control locally, was reachable or alterable in ways the original design did not intend.
Taken as a set, the three CVEs describe a device whose administrative layer was never built with internet exposure in mind, even though, in practice, thousands of these controllers sit on networks that are reachable from the open web for remote monitoring convenience.
| CVE ID | Vulnerability type | Where it lives | What it enables |
|---|---|---|---|
| CVE-2025-41450 | Authentication bypass | Undocumented “code-of-the-day” password mechanism | Administrative access without the configured password |
| CVE-2025-41451 | Command injection | Email-configuration functionality | Operating-system command execution after authentication |
| CVE-2025-41452 | External control of configuration | System configuration functions, AK-SM 8xxA family | Unauthorized alteration of device configuration |
How Claroty Team82 Found the Bugs
Claroty Team82 is the research division of Claroty, a company that specializes in securing operational technology and industrial control systems, and it has a long track record of picking apart building-management and refrigeration equipment that most cybersecurity coverage ignores. Refrigeration controllers rarely attract the same scrutiny as corporate laptops or cloud servers, in part because they are deployed by refrigeration contractors and facilities teams rather than IT departments, and in part because few researchers have the specialized hardware and protocol knowledge needed to test them.
That gap is exactly why this kind of OT-focused research matters. A compressor controller does not look like a juicy target next to a point-of-sale system or a customer database, but it sits on the same network, often with weaker oversight, and a foothold there can become a pivot point into the rest of a retailer’s infrastructure. Team82’s work on the AK-SM 8xxA family follows that pattern: find the device nobody else is looking at, test its authentication and configuration logic from the outside, and document exactly how far an unauthenticated or authenticated attacker can go.
The DEF CON Demonstration
Team82 researchers publicly demonstrated exploitation of both the code-of-the-day authentication bypass and the command-injection flaw at the DEF CON hacker convention, held in August, according to reporting on the disclosure. Showing an exploit chain live at DEF CON is a standard move in the vulnerability-disclosure playbook: it proves the bugs are real and exploitable rather than theoretical, and it pressures affected vendors and operators to patch quickly once the technical details are public.
For an OT vulnerability specifically, a conference demo also serves a second purpose. It gives facilities managers and refrigeration technicians, who may never read a CVE advisory, a visible, widely covered reason to ask their equipment vendor whether their specific model and firmware version is affected.
2,765 Exposed Systems: The Scope of the Problem
The number driving most of today’s headlines is 2,765, the count of publicly accessible Danfoss refrigeration systems that Claroty researchers identified during their internet-wide scan. That figure represents devices reachable from the open internet, not the total installed base of AK-SM controllers worldwide, which is almost certainly far larger once internal, non-internet-facing deployments are counted.
It is worth being precise about what that number does and does not establish. Some headline treatments of this story describe “thousands” of systems left open to remote takeover, and 2,765 does clear the threshold of “thousands.” But the 2,765 figure on its own is a count of internet-reachable devices Claroty was able to find through scanning, not a confirmed count of systems that remain unpatched and actively exploitable today. Whether every one of those 2,765 systems is still running vulnerable firmware, or whether some portion has already applied the fix, is not established by the scan count alone.
Why Supermarket Refrigeration Is a Target
Refrigeration controllers are an unusually attractive target for a few overlapping reasons. First, they are frequently connected to the internet on purpose, because refrigeration contractors and facilities teams want to monitor temperatures and receive fault alerts remotely without sending a technician to every store. Second, they are rarely segmented as tightly as point-of-sale or payment systems, since nobody historically treated a freezer controller as a security-sensitive asset. Third, and most consequentially, tampering with refrigeration has a physical, visible, costly consequence: spoiled inventory, food-safety violations, and in some cases a store closure, all without an attacker needing to steal a single customer record.
That combination of easy network reach, light oversight, and high real-world impact is what elevates a refrigeration-controller bug from a niche industrial-security footnote to a story with mainstream consequences. The same dynamic has already played out this year in reporting on the French supermarket refrigeration incidents, where researchers catalogued gaps across hundreds of stores tied to industrial refrigeration equipment broadly.
The Firmware Fix: R4.3.1 and the Patch Timeline
Danfoss issued a firmware update addressing the flaws, with reports citing an August 2025 release and naming firmware version R4.3.1 as the version containing the fix. That timeline means a patch has been publicly available for more than a year as of this story’s publication date, which raises the obvious operational question: why are 2,765 systems still showing up on internet scans if a fix has existed since August 2025?
The honest answer is that OT patching is slow by nature, and refrigeration equipment is a particularly stubborn category. Updating a controller that keeps a supermarket’s cold chain running is not a routine software update a store manager can click through; it typically requires scheduling a refrigeration contractor, coordinating around store hours, and in some cases physically visiting dozens or hundreds of locations one at a time. A firmware fix existing since 2025 is a necessary step, but it is not the same thing as that fix having actually been deployed across every exposed device in the field.
| Milestone | Detail |
|---|---|
| Vulnerability discovery | Claroty Team82 identifies three flaws in Danfoss AK-SM 8xxA controllers |
| Public demonstration | Exploit chain shown live at DEF CON in August |
| Firmware fix released | Danfoss ships firmware version R4.3.1, reported as August 2025 |
| Internet exposure scan | Claroty identifies 2,765 publicly accessible systems |
| Current status, Oct. 20, 2026 | Disclosure draws wide tech-press coverage; patch adoption across the exposed base is unconfirmed |
Historical Context: OT Security’s Recurring Password Problem
Hidden or predictable authentication mechanisms are one of the oldest, most persistent problems in industrial control systems. Long before smart refrigeration controllers existed, building-automation and factory-floor equipment vendors built in maintenance backdoors, default credentials, and date-based or serial-based password generators as a convenience for support technicians. Security researchers and government advisories have flagged this exact category of flaw across the OT sector for more than a decade, precisely because it tends to resurface in new product lines even after it has been called out repeatedly in older ones.
What makes the Danfoss case notable within that long history is less the novelty of the flaw type and more the scale and mundanity of the target. A compromised programmable logic controller on a factory floor sounds like a national-security story; a compromised refrigeration controller behind the deli counter sounds mundane, right up until it is tied to spoiled food, lost revenue, or a cyberattack that physically alters cooling cycles across hundreds of stores at once.
Market Impact: What This Means for Danfoss and Industrial Software Vendors
For Danfoss, a global industrial technology company whose refrigeration and climate-control hardware sits inside supermarkets, cold-storage warehouses, and commercial kitchens worldwide, a widely covered vulnerability disclosure is a reputational risk even with a firmware fix already shipped. Retail chains evaluating refrigeration contracts now have a public, documented case study to weigh against competing controller vendors, and procurement teams at large grocery chains are likely to add firmware-patch-management and authentication-architecture questions to their vendor questionnaires going forward.
More broadly, this disclosure adds to a pattern that industrial-security researchers and OT vendors have been describing for years: as refrigeration, HVAC, and building-management hardware gets internet connectivity bolted onto decades-old control logic, the software layer managing that connectivity frequently has not been held to the same scrutiny as IT systems. That gap is exactly the market opportunity OT-security vendors like Claroty, along with a growing field of ICS-focused scanning and asset-inventory tools, have built their businesses around, and disclosures like this one tend to accelerate retail and food-service spending on that category.
Competitive Comparison: How This Stacks Up Against Other ICS Disclosures
Measured against other recent operational-technology disclosures, the Danfoss case follows a now-familiar shape: a specialized OT research team finds an authentication weakness baked into a device’s firmware, pairs it with a second flaw that turns access into full command execution, and discloses both through a public conference demonstration to force vendor and customer attention. That pattern has repeated across building-automation, industrial-networking, and remote-support software in the past two years, and security researchers and government advisories have consistently pointed to hardcoded or predictable credentials as one of the most common root causes across that whole category of incident, rather than something unique to Danfoss or to refrigeration equipment specifically.
Where the Danfoss disclosure differs from, say, enterprise remote-access or backup-software vulnerabilities covered elsewhere this year is the physical consequence. A flaw in remote-support or backup infrastructure typically threatens data, while a flaw in a refrigeration controller threatens physical inventory and food safety directly, which is why retail-sector OT disclosures tend to draw outsized attention relative to their technical complexity.
What Supermarkets and Operators Should Do Now
Security teams covering retail and food-service environments generally recommend a short list of concrete steps whenever an OT advisory like this lands: confirm which specific controller models and firmware versions are deployed across every store location, apply the vendor’s fixed firmware version wherever it has not already been applied, and remove direct internet exposure for devices that do not need it by routing remote monitoring through a properly segmented and authenticated gateway rather than a device with a public IP address.
Beyond the immediate patch, the broader lesson retailers tend to draw from incidents like this is to formally inventory operational-technology assets the same way they already inventory laptops and servers. Tools built for exactly that purpose, including ICS-focused advisory trackers such as the one hosted at PlayCISO’s ICS Security Advisory Explorer, give facilities and security teams a way to check whether equipment already deployed in their stores appears on an active advisory list, rather than finding out from a news headline. Many of these same teams already run open-source monitoring stacks such as Wazuh, Security Onion, or CrowdSec on the IT side, and extending that same visibility down into OT network segments, using intrusion-detection tooling like Suricata, is one of the more practical steps a retailer can take without waiting on a vendor’s patch rollout schedule.
Predictions: What Comes Next
- Expect government cybersecurity agencies to reference the Danfoss AK-SM disclosure in future OT advisory bulletins, given the scale of the 2,765-system exposure count.
- Large grocery and retail chains will likely add firmware-patch verification and remote-access segmentation requirements to refrigeration vendor contracts over the next several quarters.
- More independent researchers are likely to turn attention toward building-management and refrigeration controllers from other vendors, following the same code-of-the-day and command-injection patterns Team82 documented here.
- Danfoss and competing refrigeration-controller vendors will likely accelerate authentication-architecture reviews across their broader AK-SM and comparable product lines, beyond just the AK-SM 8xxA family named in this disclosure.
- Expect continued overlap in coverage between this vendor-specific disclosure and the ongoing investigation into French supermarket refrigeration incidents, even though the two remain, as reported so far, separate storylines.
The Bigger Picture for Industrial Software Security
The Danfoss disclosure is ultimately a story about software quality in a category of device that most people never think about as software at all. A refrigeration controller is, underneath its industrial casing, a networked computer running an operating system, a web interface, and an authentication stack, and that stack was shown to contain the same categories of bug, hardcoded-style authentication shortcuts and unsanitized input handling, that security teams have spent two decades trying to eliminate from mainstream IT software. The fact that it took a specialized OT research team and a DEF CON demo to surface these issues publicly, more than a year after a fix was already available in firmware, says as much about patch-adoption friction in operational technology as it does about the original coding flaws.
For an industry already dealing with supermarket refrigeration incidents making headlines this year, the Danfoss case is a reminder that the attack surface extends well beyond any single vendor or any single reported incident. Every controller on a cold-chain network, from the compressor at the back of the store to the display case up front, is a small computer running code, and that code needs the same scrutiny that any internet-facing application would get.
Frequently Asked Questions
What products are affected by the Danfoss vulnerabilities?
The disclosure covers the Danfoss AK-SM 8xxA refrigeration controller family, with the AK-SM 800A specifically named as an affected product.
What are the CVE numbers for these flaws?
The three vulnerabilities are tracked as CVE-2025-41450 (authentication bypass via an undocumented code-of-the-day password mechanism), CVE-2025-41451 (command injection through the email-configuration feature), and CVE-2025-41452 (external control of system configuration).
Who discovered the Danfoss vulnerabilities?
Claroty Team82, the industrial-security research division of OT security company Claroty, identified and disclosed the flaws.
How many systems are exposed?
Claroty researchers identified 2,765 publicly accessible Danfoss refrigeration systems during an internet-wide scan. That figure counts internet-reachable devices found during the scan, not a confirmed count of systems still running unpatched firmware today.
Has Danfoss fixed the vulnerabilities?
Reports indicate Danfoss released a firmware update, version R4.3.1, in August 2025, addressing the flaws. Whether every exposed device in the field has applied that update is not confirmed by available reporting.
Is this the same incident as the French supermarket refrigeration cyberattack?
As reported so far, the Danfoss vulnerability disclosure and the separate reports of a cyberattack affecting French supermarket refrigeration are distinct storylines, though both involve industrial refrigeration-control security in the retail sector.
What was demonstrated at DEF CON?
According to reporting on the disclosure, Team82 researchers demonstrated exploitation of the code-of-the-day authentication bypass and the command-injection flaw live at the DEF CON hacker convention in August.
What should supermarkets and refrigeration operators do now?
Security guidance for operators in this situation generally centers on confirming firmware versions across every deployed controller, applying the vendor’s fixed firmware, and removing unnecessary direct internet exposure by routing remote monitoring through a properly segmented and authenticated gateway.
