Danfoss AK-SM800A through 5.3.2 has six pre-auth RCE flaws
Original title: Don't bother patching: multiple remote code execution vulnerabilities in Danfoss AK-SM800A
Midnight Blue found six stack overflows in the latest firmware and says network isolation, not patching, is the real mitigation.
Midnight Blue says the latest Danfoss AK-SM800A firmware, 5.3.2, and every earlier version contain six pre-authentication remote code execution flaws, all stack-based buffer overflows. The researchers are in coordinated disclosure with Danfoss and are withholding technical details; CVE identifiers are still pending. They warn that earlier Danfoss controller bugs were already used in attack waves starting in France on October 11, and that exposed devices should not rely on patches alone.
Unconfirmed: CVE IDs are pending, exploit details are withheld, and persistence after reset is described as possible.
- Affected range is all AK-SM800A versions up to and including 5.3.2.
- Impact includes full takeover, possible persistence after reset, and persistent denial of service.
- Suggested mitigation is VPN, private APN, or strict IP allowlists.
- Censys still saw hundreds of Danfoss systems exposed, plus similar fridge controllers.
- Public PoCs for earlier Danfoss bugs appeared within 48 hours of the French attacks.
Impact: Pre-auth remote code execution and full device takeover
| Product | Affected |
|---|---|
| Danfoss AK-SM800A | All up to and including 5.3.2 |
- 1.Restrict AK-SM800A network exposure with a VPN, private APN, or strict IP allowlists.
- Vendors
- Danfoss
- Products
- AK-SM800A
- Organizations
- Midnight Blue
- Countries
- France
From the original article
12 min read at midnightblue.nl
Prior to the attack waves which started in France on October 11th, several vulnerabilities had already been documented in multiple Danfoss product lines (AK SM-800, AK SM-800A, AK-EM100) by SynAcktiv (in 2023 [ 1 , 2 ]), Claroty (in 2025 [ 3 ]), and DIVD/HackDefense (in 2023 [ 4 ]).
By midnightblue.nl via gir · midnightblue.nl
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.