A secret daily password could allow hackers to bypass Danfoss refrigeration controls without knowing the administrator’s actual login credentials.
follow us
Add us as a preferred source on Google
- Thousands of Danfoss Refrigeration Controllers Discovered Through Public Internet Scan
- A hidden daily code could bypass normal administrator password verification
- A flaw in email configuration could allow operating system commands to be executed
Thousands of Danfoss refrigeration management systems may face remote attacks after researchers discovered dangerous authentication weaknesses and software flaws.
Claroty’s Team82 security researchers used Censys, a cybersecurity platform, to identify 2,765 publicly accessible systems.
Their research identified three vulnerabilities affecting the AK-SM 800A controller, which manages refrigeration equipment in supermarkets, warehouses and cold storage facilities.
Latest videos ofTechnologyRadar
Hidden passwords expose cooling management systems
The AK-SM 800A provides centralized monitoring and configuration of refrigeration equipment, including temperature settings, operating schedules, alarms and notification services.
Its browser-accessible management interface allows technicians to maintain installations remotely, but Internet exposure can also give attackers direct access to vulnerable systems.
Team82 discovered an undocumented authentication mechanism that could allow attackers to bypass the administrator password using a daily-generated passcode.
Designated CVE-2025-41450, the flaw involves an alternative verification process that compares a specially constructed credential with a value generated using the device’s current date.
The researchers reconstructed the algorithm responsible for generating this code by examining the controller firmware and authentication routines.
Anyone who can reproduce the algorithm could gain administrative access without knowing the legitimate password set on the affected device.
Such access could expose configuration settings and management functions normally reserved for authorized personnel.
The consequences extend beyond unauthorized account access because refrigeration controllers help operators maintain the conditions necessary to preserve perishable products.
A second vulnerability, CVE-2025-41451, allows command injection via the driver’s email configuration functionality.
The researchers discovered that an email authentication password entered through the administration interface could be incorporated into an operating system command without proper sanitization.
Therefore, malicious input could introduce additional shell commands, which could allow remote code execution after authentication.
Combined with the hidden daily password mechanism, this weakness could provide an attacker with a path from unauthorized login to executing commands on the controller.
Configuration errors threaten system availability
The investigation also identified CVE-2025-41452, which affects the controller’s externally accessible Nginx web server configuration.
The researchers discovered that an authenticated function could replace the headers.conf file and reload the server configuration without restarting the device.
An attacker with the necessary access could insert unauthorized routing policies, changing the way the web server processes requests.
Team82 also discovered that requests arriving on a maliciously configured route could trigger an unhandled exception in the sm_app process, breaking the management interface.
Repeated activation of this flaw could cause a denial of service, preventing legitimate operators from accessing the controller’s web management functions.
Such an outage could complicate monitoring and maintenance, although the researchers did not establish that each attack would cause refrigeration equipment to stop working.
Claroty’s Team82 reported the vulnerabilities privately to Danfoss through a coordinated disclosure, and the manufacturer released firmware version R4.3.1 to address the identified weaknesses.
Operators using affected AK-SM 800A controllers should update to version R4.3.1 or later and restrict administrative interfaces to trusted management networks or protected VPN connections.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment