AK-SM 800A (Product): news timeline & CVEs

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Attackers compromised exposed Danfoss and Copeland refrigeration controllers, spoiling food at nearly 700 French supermarkets.

Unknown criminals compromised internet-exposed refrigeration controllers and raised temperatures as high as 50°C, spoiling food and sparking fires across nearly 700 French supermarkets. France’s ANSSI said Danfoss controllers were widely compromised and later added Copeland and Dixell systems. Claroty’s Team82 had warned in August of authentication-bypass and OS command-execution flaws in Danfoss AK-SM 800A and Copeland XWEB devices, after earlier CISA advisories. Coalition scanning still found 1,506 exposed Danfoss StoreView panels and 1,119 XWEB login pages, with many remaining online after the attacks.

The Register · SecurityOct 15, 19:23 UTC · 1d agoExploit / PoC in the wild 19 sources2· 1 read

EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.

Attackers remotely manipulated commercial refrigeration controllers at more than 400 French grocery and retail stores, heating units to about 50°C, spoiling food and reportedly causing small fires. Two Alsace supermarkets alone reported about 270,000 euros in losses, and Sekoia said Spain, Portugal, Poland, Germany, and Belgium were also affected. The activity is linked to unpatched Danfoss AK-SM 800A flaws CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, which Claroty said allow remote code execution or denial of service. Attackers lengthened defrost cycles so the heating resembled routine maintenance; the actor and motive are unknown.

Dark Readingupdated Oct 15, 19:23 UTC · 1d agofirst Oct 15, 07:00 UTC · 1d agoExploit / PoC in the wild 19 sources CVE-2025-41450 CVE-2025-41451

Cyberattacks crank French supermarket refrigeration systems up to 50°C

Cyberattacks pushed French supermarket fridges to 50°C, spoiling food across hundreds of stores.

Cyberattacks on supermarket refrigeration controllers in France reportedly raised temperatures to 50°C (122°F), spoiling food at hundreds of stores and in some cases starting fires. Carrefour, Intermarché (about 150 stores), Monoprix (about 5% of 490 stores), and Coopérative U (80 of 2,000) were among those affected. Danfoss said impacted equipment ran outdated firmware. CERT-FR reported numerous compromises of AK-SM and AK-SC controllers and advised isolating them, resetting, patching, and rotating credentials. Claroty had previously found a predictable date-based admin bypass in the AK-SM 800A, but authorities have not confirmed that flaw was used. Coopérative U said it is not a Danfoss customer. Separately, Ahold Delhaize reported an unlinked cybersecurity incident disrupting Dutch grocery digital services and stock.

The Register · Securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 12:00 UTC · 3d agoExploit / PoC in the wild 19 sources

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Attackers remotely heated Danfoss fridge controllers at hundreds of French supermarkets, spoiling stock and causing tens of millions in losses.

On the night of October 11, attackers remotely controlled Danfoss AK-SM and AK-SC refrigeration controllers at French supermarkets, forcing defrost and heating units to as much as 50°C. Intermarché and Netto reported roughly 150 to 300 stores affected, with Carrefour, Coopérative U, Monoprix, and E.Leclerc also hit; Les Mousquetaires estimated losses in the tens of millions of euros. CERT-FR and ANSSI urged operators to disconnect the controllers or tightly filter access. Danfoss said most units were unsupported AK-SM 800 and AK-SC 355 models, plus some outdated AK-SM 800A firmware, and neither a vulnerability nor an attacker has been named.

The Hacker Newsupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 08:48 UTC · 3d agoExploit / PoC in the wild 19 sources2

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 found authentication bypass and remote code execution flaws in Danfoss AK-SM 800A controllers.

Claroty Team82 disclosed flaws in the web management interface of Danfoss AK-SM 800A refrigeration controllers used in supermarkets, cold storage, and warehouses. Researchers found a hidden code-of-the-day authentication bypass, command injection CVE-2025-41451 leading to remote code execution, and authenticated injection of arbitrary Nginx directives that can manipulate traffic or cause denial of service. Censys showed 2,765 exposed interfaces. Danfoss patched the issues in new firmware; the report does not describe in-the-wild exploitation.

Lobsters · securityupdated Oct 15, 19:23 UTC · 1d agofirst Oct 13, 07:09 UTC · 3d agoVulnerability 19 sources CVE-2025-414512

AK-SM 800A

Timeline5 articles

Related CVEsby mentions

Appears with

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Cyberattacks crank French supermarket refrigeration systems up to 50°C

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers