Key points
- Claroty identified 2,765 publicly accessible Danfoss AK-SM 800A controllers via internet scanning.
- Three vulnerabilities include a daily password bypass, command injection, and web server manipulation.
- The source material does not state whether a vendor patch or fix is available.
Danfoss AK-SM 800A controllers used in supermarkets and cold storage facilities are affected by three security flaws. Researchers at Claroty’s Team82 found that these systems allow remote administrative access and command execution. The source material does not confirm if a fix exists, so immediate isolation of internet-exposed units is necessary to prevent unauthorized control of refrigeration equipment.
In plain English
The primary issue involves an undocumented daily access code. Attackers can calculate this code using the current date, bypassing the standard administrator password. This flaw, designated CVE-2025-41450, grants full administrative access without knowing the legitimate credentials. A second flaw, CVE-2025-41451, allows command injection. When technicians enter an email password in the management interface, the system executes it as an operating system command without proper sanitization.
The background
Security researchers used Censys to discover 2,765 of these controllers connected directly to the public internet. The AK-SM 800A manages temperature settings, schedules, and alarms for perishable goods. While the browser-based interface helps technicians maintain installations remotely, direct internet exposure gives attackers immediate access to these vulnerable systems. The team reconstructed the authentication algorithm by examining the device firmware to demonstrate the daily code bypass.
What changes now
Organizations using Danfoss refrigeration management systems must verify their network exposure immediately. The presence of hidden authentication mechanisms and command injection risks means that any internet-facing controller is potentially vulnerable. Since the source does not mention an update, teams must rely on network segmentation and strict access controls to limit damage. Monitoring for unusual configuration changes or unauthorized administrative logins is essential while awaiting vendor guidance on remediation.
Who needs to act first
Teams should prioritize systems with direct internet exposure for immediate isolation. Check network logs for unauthorized access attempts to the management interface. Verify that all refrigeration controllers are behind firewalls and not publicly routable. Test any network segmentation changes in a controlled environment before rolling them out broadly. Back up current configurations to ensure recovery options remain available during remediation efforts.
Background: Network segmentation
Network segmentation for security divides a large network into smaller, isolated subnetworks. This containment strategy limits the blast radius of an intrusion. Attackers cannot move freely between segments, protecting critical assets even if one zone is compromised. It reduces risk without requiring every device to be perfectly secured.
Read the full guide: Network Segmentation for Security: Isolating Threats and Limiting Damage
What to do and how to stay safe: Danfoss
- Scan your network to identify any Danfoss AK-SM 800A controllers exposed to the public internet.
- Restrict access to the management interface to internal, trusted networks only.
- Monitor system logs for unexpected administrative logins or configuration changes.
- Isolate affected devices from critical production networks until a vendor update is released.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Danfoss products are vulnerable?
The AK-SM 800A refrigeration controller is affected by the identified authentication and command injection flaws.
How many systems were found exposed?
Claroty researchers identified 2,765 publicly accessible systems through internet scanning platforms.
Is there a patch available for these vulnerabilities?
The source material does not state whether a patch or fix is currently available.
