Freeze the Controller, Defrost the Food: Flaws in Danfoss Refrigeration Controllers

Danfoss AK-SM 800A controllers manage refrigeration equipment in supermarkets, cold-storage facilities, and commercial buildings. From a single web panel an operator watches cooling circuits, sets temperature thresholds and schedules, and manages user permissions. That central role is exactly what makes the panel an attractive target: compromising the management plane carries very physical consequences.

Claroty Team82 started with a simple question — can an attacker even reach these devices from outside? A search on Shodan and Censys answered it quickly: according to Censys, roughly 2,765 AK-SM 800A controllers were directly reachable on the public internet, carrying the distinctive StoreView interface title. Administrators had exposed the console for convenient remote maintenance — and in doing so lowered the barrier to entry for an attacker.

Code of the day

Reverse engineering the firmware, the team reconstructed the embedded web service: an external Nginx acting as a reverse proxy, CGI handlers, and core logic in separate processes. In the authentication path (action="getauth") they found a hidden branch. With certain parameters set, the password check was swapped for a check_code_of_day routine that compared the supplied value not against the configured administrator password, but against a "code of the day" derived from the device's current date.

Team82 fully reconstructed the algorithm that generates this code. Anyone able to reproduce it can mint valid credentials for any given day and land a fully authenticated administrative session, bypassing the normal login (CVE-2025-41450).

From bypass to code execution

Full access to the admin interface opened up dozens of configuration pages. The SMTP email settings stood out: the email authentication password was formatted into an operating-system shell command without any sanitization. Through that field an attacker can inject shell directives and achieve remote code execution (CVE-2025-41451).

A separate finding involved headers.conf, a file included in the external Nginx configuration. The web application let an authenticated user replace this file and reload Nginx at runtime. That allowed arbitrary routing directives to be implanted — and a request to a maliciously implanted route triggered an unhandled exception in the sm_app process, crashing the web service and enabling a repeatable denial-of-service condition (CVE-2025-41452).

Fixes

After receiving the report through coordinated disclosure, Danfoss released firmware R4.3.1 addressing the issues. Owners are advised to upgrade, keep management interfaces off the public internet, and restrict access to trusted networks, VPNs, and proper segmentation.

Source: Lobsters