A nightmare scenario for supermarkets: Hidden daily passwords and command injection flaws leave thousands of Danfoss supermarket systems open to remote takeover

Date:
Tue, 20 Oct 2026 20:25:00 +0000

Description:
Claroty researchers found 2,765 publicly accessible Danfoss refrigeration systems and three vulnerabilities involving hidden passwords, command injection, and web server manipulation.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Thousands of Danfoss refrigeration controllers were discoverable through public internet scanning
A hidden daily code could bypass normal administrator password verification
An email configuration flaw could enable operating system command execution Thousands of Danfoss refrigeration management systems may face remote attacks after researchers uncovered authentication weaknesses and dangerous software flaws.

Security researchers at Clarotys Team82 used Censys, a cybersecurity
platform, to identify 2,765 publicly accessible systems. Their investigation identified three vulnerabilities affecting the AK-SM 800A controller, which manages refrigeration equipment in supermarkets, warehouses and cold storage facilities. Latest Videos From TechRadar Watch full video here: Hidden passwords expose refrigeration management systems The AK-SM 800A provides centralized monitoring and configuration of refrigeration equipment,
including temperature settings, operating schedules, alarms, and notification services.

Its browser accessible management interface allows technicians to maintain installations remotely, but internet exposure can also give attackers direct access to vulnerable systems. You may like Buggy microcontrollers making up some of the world's most important servers can be easily backdoored TP-Link router owners update now 15 flaws patched to stop hackers hijacking your devices Ahold Delhaize takes systems offline after cyberattack global retail giant says 'cybersecurity incident' hit systems, but stores remain open

Team82 discovered an undocumented authentication mechanism that could allow attackers to circumvent the administrator password through a daily generated access code.

Designated CVE-2025-41450, the flaw involves an alternative verification process that checks a specially constructed credential against a value generated using the devices current date. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Researchers reconstructed the algorithm responsible for generating this code by examining the controllers firmware and authentication routines.

Anyone able to reproduce the algorithm could potentially obtain
administrative access without knowing the legitimate password configured on the affected device.

That access could expose configuration settings and management functions normally reserved for authorized personnel. What to read next Cisco patches three critical vulnerabilities as part of 'comprehensive internal security review' Expert finds this 3 Temu Wi-Fi extender is full of security issues, and definitely not the bargain you'd hoped for Hackers are using evolved capabilities in AI-generated malware to hit US critical infrastructure

The consequences extend beyond unauthorized account access because refrigeration controllers help operators maintain conditions required for preserving perishable products.

A second vulnerability, CVE-2025-41451, allows command injection through the controllers email configuration functionality.

Researchers found that an email authentication password entered through the management interface could be incorporated into an operating system command without adequate sanitization.

Malicious input could therefore introduce additional shell commands, potentially enabling remote code execution after authentication.

Combined with the hidden daily password mechanism, this weakness could
provide an attacker with a route from unauthorized login to execution of commands on the controller. Configuration flaws threaten system availability The investigation also identified CVE-2025-41452, which affects the controllers externally accessible Nginx web server configuration.

Researchers discovered that an authenticated function could replace the headers.conf file and reload the server configuration without restarting the device.

An attacker with the necessary access could insert unauthorized routing directives, changing how the web server processes requests.

Team82 also found that requests reaching a maliciously configured route could trigger an unhandled exception in the sm_app process, disrupting the management interface.

Repeatedly triggering this failure could cause a denial of service,
preventing legitimate operators from accessing the controllers web management functions.

Such disruption could complicate monitoring and maintenance, although the researchers did not establish that every attack would cause refrigeration equipment to stop operating.

Clarotys Team82 reported the vulnerabilities privately to Danfoss through coordinated disclosure, and the manufacturer released firmware version R4.3.1 to address the identified weaknesses.

Operators using affected AK-SM 800A controllers should upgrade to version R4.3.1 or later and restrict administrative interfaces to trusted management networks or protected VPN connections. Follow TechRadar on Google News and
add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/a-nightmare-scenario-for-supermarkets-hidden-dai ly-passwords-and-command-injection-flaws-leave-thousands-of-danfoss-supermarke t-systems-open-to-remote-takeover


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)