Ole-K2-Danfoss-Firmware-Disclosure

Ole-K2 Danfoss Firmware Disclosure Researcher: Ole-k2 In...

New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled...

VulnCheck KEV: CVE-2025-41452

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions...

VulnCheck KEV: CVE-2025-41451

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command 'Command Injection' in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system...

PT-2026-115090

Attackers converted grocery store refrigeration systems into heating units, reaching 50°C 120°F across 400+ European stores. They exploited Internet-exposed Danfoss controllers via CVE-2024-41450/41451/41452, then moved laterally through OT networks to coordinate simultaneous temperature...

Cyberattack on Connected Fridges in France

Another IoT cyberattack, this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C 120F overnight, according to one supermarket chain affected. … Normally, supermarket freezers go through a short period of...

You don’t need a nation state to warm up a fridge

TL;DR Over the night of the 11th of October 2026, the fridges and freezers in several hundred French supermarkets were made to warm up. Stock was binned, some equipment reportedly caught fire, and losses run to tens of millions of euros. The controllers are Danfoss AK-SM and AK-SC units, many...

VulnCheck KEV: CVE-2025-41450

Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2...

Danfoss AK-SM 8xxA Authentication Bypass

Danfoss AK-SM 8xxA series versions prior to version 4.2 contain an improper authentication vulnerability that permits a code-of-the-day authentication bypass. This proof of concept obtains the device date, derives the daily code, and exercises the alternate authentication path...

Hackers heat up supermarket fridges, spoiling food across France

A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold. The attack caused significant financial losses and food waste. Some installations reportedly reached temperatures of around 50°...

danfoss-ak-sm-decoy

coldstore — a refrigeration system-manager decoy A second lur...

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the controller that runs all of a store's fridges and freezers, a...

Exploit for CVE-2025-41450

Danfoss AK-SM 8xxA — CVE-2025-41450 / -41451 / -41452 PoC tool...

Danfoss AK-SM800A External Control of System or Configuration Setting (CVE-2025-41452)

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions. This plugin only works with Tenable.ot. Please visit...

Danfoss AK-SM800A Command Injection (CVE-2025-41451)

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command 'Command Injection' in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system. This plugin only works with Tenable.ot. Please...

EUVD-2026-66251

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

CVE-2026-15203

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

CVE-2026-15203

Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 suffer from improper access control in debug and engineering interfaces that are accessible by default. An unauthenticated, network-based attacker can read and write internal values , upload and execute unsigned applications , and upload u...

CVE-2026-15203 Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

CVE-2026-15203 Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...