Six Danfoss AK-SM800A zero-days allow pre-auth root access
Original title: Researchers Discover 6 Zero-Day Vulnerabilities in Danfoss Refrigeration Controllers Allowing Remote Root Access
Every firmware version through 5.3.2 is affected; CVE IDs are pending and exploit endpoints are withheld.
Midnight Blue researcher Carlo Meijer found six pre-authentication remote code execution flaws in the Danfoss AK-SM800A refrigeration controller during a short firmware review. All versions up to and including 5.3.2 are affected, including a bug in sm_fcgi_app that works with strict session control. The binaries lack stack canaries and PIE and run as root on Danux. Separately, attacks on internet-exposed Danfoss and Copeland controllers in France began on October 11 and resumed on November 2.
Unconfirmed: The article does not say the six new flaws were used in the French attacks; CVE identifiers are still pending.
- A crafted request to an unauthenticated CGI endpoint can crash the web task.
- Root access could survive factory reset because i.MX6 secure boot is unused.
- Censys still shows hundreds of exposed Danfoss systems and more than 1,000 Copeland and Dixell units.
- Owners are told to find exposed units, including those behind 4G modems, and limit access by VPN, private APN or IP allowlists.
- Earlier public flaws include CVE-2025-41450, CVE-2023-25915, CVE-2025-41451 and CVE-2023-25914.
Impact: Pre-authentication remote root code execution and device bricking
| Product | Affected |
|---|---|
| Danfoss AK-SM800A | All up to and including 5.3.2 |
- 1.Find every exposed controller, including units behind integrator 4G modems.
- 2.Restrict management access to a VPN, private APN or tightly scoped IP allowlists.
- Organizations
- Midnight BlueCISAFBICERT-FR
- Countries
- France
From the original article
3 min read at gbhackers.com
Midnight Blue researcher Carlo Meijer found six pre-authentication remote code execution zero-days in the Danfoss AK-SM800A refrigeration controller. He found them in under an hour of manual firmware review. All firmware versions up to and including 5.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.