Researchers have uncovered six remote code execution vulnerabilities in Danfoss’ AK-SM800A refrigeration controllers used in supermarkets. These are pre-authentication flaws based on stack-based buffer overflows, which can let attackers seize control of the system without valid login credentials. Every firmware version up to and including 5.3.2 is affected, and as of now, no CVEs have been issued.
What’s at Risk?
The vulnerabilities were discovered by a researcher with Midnight Blue during internal testing of the firmware. By analyzing the code in an emulator, the researcher pinpointed multiple instances where the unsafe C function strcpy was used—allowing input overflow if provided strings exceed expected lengths. One such issue was in a web handler, which crashed upon receiving a long string of characters. At least five such bugs were found in the same module.
Danfoss’ system runs without basic security protections like stack canaries or Position-Independent Executables (PIE). Because the main program operates with root privileges, compromising it yields full control over the device. One of the flaws lies in sm_fcgi_app, which handles login checking. That component allows an overflow, even when the controller is set to its latest firmware with “strict” session control enabled.
Real-World Impact and Ongoing Attacks
Since October 11, Danfoss and related Copeland refrigeration units exposed to the internet across Europe have been targeted. Attackers triggered defrost cycles, causing food loss, and the resulting damages have ramped up into the tens of millions of euros. In several locations, thermal stress led to secondary incidents, including fires.
Governments and agencies have begun pointing fingers over the source of these attacks. France has blamed Iran’s Shahid Kaveh unit, but researchers caution that attribution remains unconfirmed. Some reports instead focus on exposed admin panels and weak passwords as entry points—rather than the newly reported flaws.
Protections, But Partial
Danfoss introduced a firmware setting called “strict” session control in version 4.0, which disables many public-facing web endpoints for unauthenticated users. CERT-FR has issued guidance citing it as a mitigation. Yet even with those protections enabled, the overflow in the login-checking module can still be exploited.
Worse, the hardware doesn’t use the secure boot capabilities of the i.MX6 processor. That means a successful attacker with root access could install persistent implants, rewrite firmware, or wipe flash storage to brick devices—a form of disruption akin to wiper attacks seen in prior critical infrastructure breaches.
Urgent Steps for Defenders
Researchers warn that patching individual flaws is not enough. Organizations should first identify every controller exposed to the internet—including those connected via integrators’ 4G networks. Remote access should be locked down using VPNs, private APNs, or IP allow lists. However, allow-listing is seen only as a stopgap measure until firmware patches become available.
Exposure is still widespread: scans show hundreds of Danfoss systems, plus over a thousand Copeland and Dixell units, accessible online. Previous discoveries in similar refrigeration controllers with vulnerabilities suggest the threat is systemic—and potentially puts critical supplies like food and medicine at risk.
This development exposes a troubling trend: essential infrastructure components, even those as mundane as commercial fridge controllers, are now critical attack vectors. Operational technology once considered low-risk is being weaponized, and the cost of inaction—both in dollars and safety—can be massive. What to watch: whether Danfoss releases firmware updates that fully address all six overflows, how governments attribute attacks, and whether exposure levels fall as organizations adopt stricter network controls.
