A nightmare scenario for supermarkets: Hidden daily passwords and command injection flaws leave thousands of Danfoss supermarket systems open to remote takeover

Researchers at Claroty’s Team82 uncovered authentication vulnerabilities affecting thousands of Danfoss refrigeration controllers used in supermarkets and cold storage facilities. By analyzing publicly accessible systems with Censys, they discovered three critical flaws impacting the AK-SM 800A controller, which manages refrigeration equipment remotely.

The first flaw, CVE-2025-41450, allows attackers to bypass the administrator password through a daily-generated access code. This hidden password mechanism could be reproduced by criminals to gain administrative access to the controller without knowing the legitimate password, potentially exposing sensitive configuration settings and alarm services.

The second vulnerability, CVE-2025-41451, enables command injection via the controller’s email configuration function. Malicious input entered through the management interface could be integrated into operating system commands, allowing remote code execution after successful authentication. This could let attackers execute arbitrary commands on the controller, threatening its availability and functionality.

A third flaw, CVE-2025-41452, targets the controller’s Nginx web server. An authenticated attacker could modify the headers.conf file without restarting the device, altering how the web server processes requests. This could result in denial of service disruptions, preventing authorized personnel from accessing the controller’s management interface and monitoring equipment performance.

Danfoss released firmware version R4.3.1 to mitigate these vulnerabilities, recommending operators upgrade their AK-SM 800A controllers and restrict administrative access to trusted networks or VPN connections. The researchers privately disclosed the vulnerabilities to Danfoss for coordinated patching.