{
  "id": 15799087,
  "title": "A nightmare scenario for supermarkets: Hidden daily passwords and command injection flaws leave thousands of Danfoss supermarket systems open to remote takeover",
  "url": "https://urgent.news/2026/10/20/a-nightmare-scenario-for-supermarkets-hidden-daily-passwords-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T20:25:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/a-nightmare-scenario-for-supermarkets-hidden-daily-passwords-and-command-injection-flaws-leave-thousands-of-danfoss-supermarket-systems-open-to-remote-takeover"
  },
  "original_language": "en",
  "account": "Researchers at Claroty’s Team82 uncovered authentication vulnerabilities affecting thousands of Danfoss refrigeration controllers used in supermarkets and cold storage facilities. By analyzing publicly accessible systems with Censys, they discovered three critical flaws impacting the AK-SM 800A controller, which manages refrigeration equipment remotely.\n\nThe first flaw, CVE-2025-41450, allows attackers to bypass the administrator password through a daily-generated access code. This hidden password mechanism could be reproduced by criminals to gain administrative access to the controller without knowing the legitimate password, potentially exposing sensitive configuration settings and alarm services.\n\nThe second vulnerability, CVE-2025-41451, enables command injection via the controller’s email configuration function. Malicious input entered through the management interface could be integrated into operating system commands, allowing remote code execution after successful authentication. This could let attackers execute arbitrary commands on the controller, threatening its availability and functionality.\n\nA third flaw, CVE-2025-41452, targets the controller’s Nginx web server. An authenticated attacker could modify the headers.conf file without restarting the device, altering how the web server processes requests. This could result in denial of service disruptions, preventing authorized personnel from accessing the controller’s management interface and monitoring equipment performance.\n\nDanfoss released firmware version R4.3.1 to mitigate these vulnerabilities, recommending operators upgrade their AK-SM 800A controllers and restrict administrative access to trusted networks or VPN connections. The researchers privately disclosed the vulnerabilities to Danfoss for coordinated patching.",
  "summary": "Claroty researchers found 2,765 publicly accessible Danfoss refrigeration systems and three vulnerabilities involving hidden passwords, command injection, and web server manipulation.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}