Claroty Team82: Danfoss AK-SM 800A refrigeration system managers — undocumented 'code-of-the-day' authentication bypass and post-authentication command-injection RCE across roughly 2,765 internet-exposed devices

Claroty Team82: Danfoss AK-SM 800A refrigeration system managers — undocumented 'code-of-the-day' authentication bypass and post-authentication command-injection RCE across thousands of internet-exposed devices

Companion disclosure to Claroty Team82's Copeland XWEB Pro research, published the same day (2026-08-09T17:59Z), covering the Danfoss AK-SM 800A refrigeration system-manager platform used in supermarkets, cold-storage facilities and commercial HVAC. Claroty found "thousands of publicly accessible management interfaces" via internet-wide scan data, using platforms including Shodan and Censys: "to understand the real-world exposure of the Danfoss AK-SM 800A, we searched publicly available internet-wide scanning platforms" (Claroty Team82, 2026-08-09) — Claroty does not publish a precise device count.

CVE-2025-41450 (CWE-287 Improper Authentication, CVSS 3.1 8.2) is a hidden, undocumented "code-of-the-day" authentication mechanism: the application accepts a specially crafted authentication request containing a generated "code of the day" that bypasses normal login and discloses a web report with internal IPs, usernames and store names — "the application accepts a specially crafted authentication request containing a generated 'code of the day'" (Claroty Team82, 2026-08-09) — patched in firmware build 4.2. CVE-2025-41451 (CWE-77 OS Command Injection, CVSS 3.1 7.6) is a post-authenticated command injection in the alarm-to-email (SMTP) configuration field: a user-supplied value is formatted unsanitized into a shell command executed on the device, which Claroty used to achieve remote code execution: "the field value being formatted into the shell command is not sanitized and could include OS shell directives controlled by an attacker" (Claroty Team82, 2026-08-09). CVE-2025-41452 (CWE-15 External Control of Configuration Setting, CVSS 3.1 5.4) lets a post-authenticated user inject arbitrary Nginx directives via the exposed headers.conf include: "an attacker could abuse it to implant arbitrary routing directives into the Internet-facing Nginx configuration" (Claroty Team82, 2026-08-09), enabling denial-of-service. Danfoss shipped firmware R4.3.1 fixing CVE-2025-41451/41452 (build 4.2 for CVE-2025-41450). The RCE and Nginx-injection primitives require prior authentication; Claroty's article does not explicitly confirm the code-of-the-day mechanism as a pre-auth path into the two post-auth primitives, so this entry treats the chain as auth-gated unless a combined path is independently confirmed.

The undocumented authentication mechanism is instructive tradecraft on its own terms even setting aside the RCE chain: a hidden authentication bypass disclosing internal network topology (IPs, usernames, store identifiers) before an attacker needs any further vulnerability is exactly the class of vendor-authentication-mechanism audit finding that a Tier 2/3 responder auditing an OT/building-management estate should be watching for, distinct from a conventional missing-authentication bug. Triage: monitor authentication attempts against AK-SM 800A management interfaces for requests carrying a non-standard authentication parameter shape (a "code" field distinct from the normal username/password flow) — legitimate operator logins never use the code-of-the-day mechanism, so its presence in a request is itself the discriminator. On the post-auth side, unexpected shell-metacharacter content in the alarm-email SMTP configuration field, or unexplained changes to the device's Nginx routing configuration, have no benign explanation for a device whose configuration should change only through documented administrative workflows.