Danfoss refrigeration controllers exposed to remote attack via hidden daily password and command injection flaws

Team82 used Censys, a cybersecurity platform, to find the internet-exposed systems. The AK-SM 800A manages refrigeration equipment in supermarkets, warehouses and cold storage facilities, providing centralized monitoring and configuration for temperature settings, operating schedules, alarms and notification services. Its browser-accessible management interface lets technicians maintain installations remotely, but internet exposure can also give attackers direct access to vulnerable systems.

The first flaw, CVE-2025-41450, involves an undocumented authentication mechanism that could let an attacker circumvent the administrator password through a daily generated access code. The alternative verification process checks a specially constructed credential against a value generated using the device's current date. Researchers reconstructed the algorithm responsible for generating the code by examining the controller's firmware and authentication routines. Anyone able to reproduce the algorithm could potentially obtain administrative access without knowing the legitimate password configured on the device, exposing configuration settings and management functions normally reserved for authorized personnel. Because refrigeration controllers help operators maintain conditions required for preserving perishable products, unauthorized access could have consequences beyond account compromise.

The second flaw, CVE-2025-41451, allows command injection through the controller's email configuration functionality. Researchers found that an email authentication password entered through the management interface could be incorporated into an operating system command without adequate sanitization. Malicious input could therefore introduce additional shell commands, potentially enabling remote code execution after authentication. Combined with the hidden daily password mechanism, this weakness could provide an attacker with a route from unauthorized login to execution of commands on the controller.

The investigation also identified CVE-2025-41452, which affects the controller's externally accessible Nginx web server configuration. Researchers discovered that an authenticated function could replace the headers.conf file and reload the server configuration without restarting the device. An attacker with the necessary access could insert unauthorized routing directives, changing how the web server processes requests. Team82 also found that requests reaching a maliciously configured route could trigger an unhandled exception in the sm_app process, disrupting the management interface. Repeatedly triggering this failure could cause a denial of service, preventing legitimate operators from accessing the controller's web management functions. The researchers did not establish that every attack would cause refrigeration equipment to stop operating.

Team82 reported the vulnerabilities privately to Danfoss through coordinated disclosure, and the manufacturer released firmware version R4.3.1 to address the identified weaknesses. Operators using affected AK-SM 800A controllers should upgrade to version R4.3.1 or later and restrict administrative interfaces to trusted management networks or protected VPN connections, TechRadar reported.