CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Danfoss AK-SM 800A

product · product:danfoss-ak-sm-800a single-source

Coverage
2
first 2026-08-28 → last 2026-10-19
Latest activity
2026-10-18
CERT-FR adds Copeland and Dixell xweb to the hijacked refrigeration controllers; NCSC.ch rates the attacks…
Peak priority
high
1 high · 1 notable
Targets
retail
sectors: retail, healthcare, energy · regions: europe, switzerland
Sources cited
14
14 hosts

Action items (3)

Do-now tasks recorded on the entries about Danfoss AK-SM 800A, newest first. Check the date before acting on an older one.

  • Find every Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controller in facilities you own or that a contractor manages for you and take its management interface off the internet now, restoring access only through a secure VPN or protected network (filtering to the contractor's source addresses is an emergency stop-gap, and CERT-FR asks you to check your insurance conditions before cutting the contractor's data uplink); an end-of-life unit that gets no fixes needs replacing, because a factory reset leaves it vulnerable and probably compromised again.
    2026-10-13CERT-FR adds Copeland and Dixell xweb to the…
  • On every such controller that was reachable from the internet, check the whole configuration, defrost ranges included, against the intended one; for a Danfoss unit that may have been taken over, restart it or otherwise factory-reset it, restore access only through a secure VPN or protected network and reconfigure it for service, then update its firmware, set the security level to Strict and change the default passwords, and on every Copeland or Dixell XWEB unit confirm the factory Admin password was changed and give each contractor a named account with an expiry date.
    2026-10-13CERT-FR adds Copeland and Dixell xweb to the…
  • Upgrade Danfoss AK-SM 800A refrigeration system managers to firmware R4.3.1 (build 4.2 closes CVE-2025-41450 alone) on every deployment, and treat any of the thousands of internet-exposed devices Claroty found via public internet-scan platforms as a priority, take management interfaces off the public internet entirely where the upgrade cannot happen immediately.
    2026-08-28CVE-2025-41450 +2

Defender insights

What each entry about Danfoss AK-SM 800A tells a defender to do, newest first.

2026-10-13HIGHexploitedCERT-FR adds Copeland and Dixell xweb to the hijacked refrigeration controllers; NCSC.ch rates the attacks exploited

Exposure · triage · detection

2026-08-28NOTABLEA hidden authentication mechanism discloses internal network layout before an attacker even needs the two post-auth flaws that follow it

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

affected by

Story timeline

  1. 2026-10-13Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR and NCSC Switzerland say to remove internet exposure
    active-threatsCERT-FR adds Copeland and Dixell xweb to the hijacked refrigeration controllers; NCSC.ch rates the attacks exploited
  2. 2026-08-28Claroty Team82: Danfoss AK-SM 800A refrigeration system managers, undocumented 'code-of-the-day' authentication bypass and post-authentication command-injection RCE across thousands of internet-exposed devices
    trending-vulnerabilitiesA hidden authentication mechanism discloses internal network layout before an attacker even needs the two post-auth flaws that follow it

Hunting pivots

CVEs
CVE-2025-41450CVE-2025-41451CVE-2025-41452
Releases covered
Danfoss AK-SM 800A ×2
Tags
ot-ics ×2actively-exploitedauth-bypasspatch-availablercevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack · 2026-08-28/claroty-danfoss-ak-sm-800a-code-of-the-day-rce · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-08-28/claroty-danfoss-ak-sm-800a-code-of-the-day-rce · ATT&CK page ↗

Entries about Danfoss AK-SM 800A (2)

2026-10-13 · view entry permalink →

HIGHexploitedupdatedNATOA2

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR and NCSC Switzerland say to remove internet exposure

Coopérative U, Intermarché and E. Leclerc confirmed to AFP a cyberattack on their refrigeration systems overnight on 11 to 12 October 2026; AFP reports from the retailers' statements at least 300 Intermarché or Netto shops and more than 100 Coopérative U outlets, and the Paris prosecutor opened an investigation (AFP, 2026-10-12). BFMTV puts the Intermarché and Netto count at 300, which it says is twice the first estimates of 150 points of sale, and Coopérative U below 100 stores, while Infosecurity quotes 150 Intermarché and 30 Netto stores (BFMTV, 2026-10-12; Infosecurity Magazine, 2026-10-12). BFMTV, writing in the conditional, reports that the attackers are said to have imposed a forced, continuous defrost with the setpoint at 50 degrees, on software older than version 4, heating the equipment for hours (translated from French) (BFMTV, 2026-10-12). CERT-FR's alert, in its revision of 2026-10-13, says it knows of numerous compromises of the remote refrigeration controllers Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb, and that exposing a management interface to the internet is contrary to good practice (CERT-FR, 2026-10-13). Danfoss told AFP that most affected units are legacy products that no longer receive software or security updates, naming the AK-SM800 and AK-SC355 regulators, and a person close to the Prime Minister said ANSSI had identified a vulnerability in software from a Danish company and that other countries may be affected (AFP, 2026-10-12). Intermarché told BleepingComputer that the attack reportedly affected a service provider that manages refrigeration systems in stores (BleepingComputer, 2026-10-12), and E. Leclerc told AFP that a cyberattack affected one of its refrigeration equipment suppliers (AFP, 2026-10-12). Infosecurity says the affected stores include those running vulnerable consoles with remote control and no adequately secured communication channel (Infosecurity Magazine, 2026-10-12). No source names an actor or the flaw or states how the attackers got in, and none confirms a tie to the 2025 AK-SM 8xxA vulnerabilities that Claroty found: BleepingComputer reports no tie (BleepingComputer, 2026-10-12) and NCSC Switzerland lists three of them only as alleged to be potentially related (NCSC Switzerland, 2026-10-13); Censys names the same three as flaws that Danfoss patched more than a year earlier and says Danfoss has not confirmed the initial access vector (Censys, 2026-10-14).

Triage: a defrost cycle is normal; BFMTV reports, citing sector professionals, that installations can be programmed for two hours of defrost per 24 hours, whereas the reported attack is said to be a continuous forced defrost at a 50-degree setpoint held for hours (translated from French) (BFMTV, 2026-10-12).

CERT-FR is aware of numerous compromises of the remote refrigeration-installation controllers Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb. (translated from French)

In an emergency, simply filtering the source IPs of the refrigeration contractors on a firewall is possible, but this solution must not be considered lasting. (translated from French)

the persistence of a compromised instance will be removed but the equipment will remain vulnerable and will certainly be compromised again. (translated from French)

CERT-FR (alert CERTFR-2026-ALE-012) 2026-10-12

most of the affected equipment was "legacy" products which "no longer receive software or security updates"

AFP 2026-10-12

the hackers would have hijacked this function by imposing a forced and continuous defrost, with a temperature setpoint fixed at 50 degrees (translated from French)

BFMTV 2026-10-12

Affected stores include those operating vulnerable Danfoss consoles with remote-control capabilities that lacked an adequately secured communication channel.

Infosecurity Magazine 2026-10-12

the majority of units affected were legacy products or current products running outdated firmware

Cooling Post 2026-10-12

While Danfoss has not confirmed the exact initial access vector, it says most affected controllers were either older models that no longer received security updates or newer models running outdated firmware.

Censys 2026-10-14

Verify the entire configuration, notably the defrost ranges. (translated from French)

Restart the Danfoss equipment, otherwise restore the equipment (Reset Factory). (translated from French)

CERT-FR (alert CERTFR-2026-ALE-012, third version) 2026-10-16

We acknowledge the existence of the vulnerability identified on a generation of XWEB EVO controllers that is no longer marketed and has reached end of life. (translated from French)

Immediately remove all XWEB EVO units from the public internet, then look for any suspicious activity from the local network and restore the devices if necessary. (translated from French)

Dixell France (Copeland) 2026-10-14

the hackers had raised the duration of the operation from one hour to eight hours so that the alarms trigger late (translated from French)

Le Monde 2026-10-12

A spokesperson for Copeland confirmed that a vulnerability was found in discontinued end-of-life controllers.

Cybersecurity Dive 2026-10-15

but it has since acknowledged a vulnerability

SecurityWeek 2026-10-15
Updaterun 2026-10-14T0255Z-inteltitleheadlinesummaryregionsentitiesaffected_productssourcesevidencesourcing_notereferencesactionsbody

CERT-FR revised its alert on 2026-10-13: the list of compromised remote controllers now includes Copeland xweb and Dixell xweb besides Danfoss AK-SM and AK-SC, campaigns against these devices are probably still ongoing, and an unpatched end-of-life unit kept on the internet is very likely to be compromised, so a factory reset alone is insufficient (CERT-FR, 2026-10-13). NCSC Switzerland published advisory 13054 on 2026-10-13 with the exploitation status Actively Exploited. It lists the Danfoss AK-SM 800 (end of life, no longer patched), the AK-SC 355 (phased out, no longer patched) and the current AK-SM 800A series when it runs outdated firmware, says no fixes exist for the two older models and that Danfoss urges replacing them, and says the attack could affect other sectors, such as healthcare for specialized cooling equipment, so organisations should check whether affected devices are in use (NCSC Switzerland, 2026-10-13). Danfoss told Cooling Post that the AK-SM800 was declared end of life in 2021, that the AK-SC355 was phased out in 2016, and that the affected AK-SM800A systems ran outdated firmware (Cooling Post, 2026-10-12). Blick reports that Migros uses the same Danfoss refrigeration systems in a limited number of Swiss stores and sees no sign they were targeted, and that Aldi, Lidl and Coop say they are not affected (Blick, 2026-10-13); no source reports a Swiss victim. The advisory relays a six-step CERT-FR sequence (limit access to trusted addresses, factory reset, apply all fixes, rotate passwords and secrets, review accounts, reconfigure) and lists filtering to trusted addresses as a temporary measure (NCSC Switzerland, 2026-10-13), whereas the revised CERT-FR page puts removal of internet exposure first, accepts source-address filtering only as an emergency stop-gap and lists no secret rotation or account review (CERT-FR, 2026-10-13).

Improvementrun 2026-10-15T0256Z-intelsourcesevidencesourcing_notebody

Censys, which scans for Danfoss StoreView control panels, says Danfoss has not confirmed the initial access vector and points to three AK-SM 800A flaws that Danfoss patched more than a year earlier: CVE-2025-41450 (March 2025), which Censys describes as letting an unauthenticated actor log in as an administrator with a code computed from the current calendar date, and CVE-2025-41451 and CVE-2025-41452 (August 2025), which it says let authenticated users run commands and disrupt the management interface (Censys, 2026-10-14). Censys maps the firmware by build: below 4.2 carries all three, 4.2.4 fixes only the date-based login and still carries the two later ones, and 4.3.1 or later fixes all three (Censys, 2026-10-14). Its scan counted 1,825 exposed StoreView panels in France on 2026-10-11 and 537 on 2026-10-14, a fall of 71 percent, with builds below 4.2, build 4.2.4 and builds from 4.3.1 leaving at about the same rate, which it reads as operators taking controllers off the internet rather than patching them (Censys, 2026-10-14). Outside France the count fell from 1,166 to 966, and in ten of the twelve countries with the most exposed hosts more than 60 percent of the hosts run a build below 4.3.1, led by Poland at 81 percent and Romania at 80 percent (Censys, 2026-10-14).

Updaterun 2026-10-18T0256Z-intelsummaryactionssourcesevidencesourcing_notebody

CERT-FR's alert now has a third version, dated 2026-10-16 and listed on the page as an update of the recommendations; the page does not show which sentences changed (CERT-FR, 2026-10-16). Its current text separates the two cases. For every unit it asks to remove the internet exposure of the affected units and of any unit on a public IP address, and to check the insurance contract conditions before cutting the data uplink to the refrigeration contractor (CERT-FR, 2026-10-16). For a unit not known to be compromised it then asks to check the whole configuration, notably the defrost ranges; for a compromised Danfoss unit it says to restart the equipment or otherwise restore it with a factory reset, and then to reconfigure it for service (CERT-FR, 2026-10-16). In both cases access returns only through a secure VPN or protected network, with source-address filtering for the contractors an emergency measure and not a lasting one, and the maker's practices apply (CERT-FR, 2026-10-16). The alert still says campaigns are probably ongoing, still names no flaw or entry vector, and gives the risk as not specified by the vendor (CERT-FR, 2026-10-16).

The alert's documentation section links an operator guide from Dixell France (Copeland) (CERT-FR, 2026-10-16). The file at that address was replaced on 2026-10-18; its current text, described in the correction of 2026-10-19T04:06:00Z, is Copeland's bulletin of 14 October 2026 followed by Dixell France's own complement (Dixell France, 2026-10-14). That complement says XWEB PRO and EVO ship with the same factory account, Admin with the password Admin, advises keeping the original Admin password sealed or in a password manager and not using it daily, gives each user a named account with an expiry date for an external contractor's account, and requires remote access through an encrypted VPN, with no port forward or DMZ and no remote-control software such as AnyDesk or TeamViewer on a site PC that stays on (Dixell France, 2026-10-14). CERT-FR does not say how the attackers got in, and SecurityWeek writes that neither Danfoss nor French authorities have tied the attack to the flaws Claroty disclosed (CERT-FR, 2026-10-16; SecurityWeek, 2026-10-15).

Correctionrun 2026-10-19T0256Z-intelsummarysourcesevidencesourcing_notebody

The Dixell France guide that CERT-FR links was replaced on 2026-10-18, the file's date on the vendor's server, and now opens with Copeland's own security bulletin dated 14 October 2026 (Dixell France, 2026-10-14). The earlier update section's statements about XWEB PRO firmware 1.12.1, a CISA advisory and a March 2024 bulletin are no longer on that page and are removed from the summary and the body. The bulletin acknowledges the vulnerability on a generation of XWEB EVO controllers that is no longer marketed and has reached end of life, says to remove every XWEB EVO from the public internet immediately and then look for suspicious activity from the local network, and says XWEB EVO no longer receives security patches, while XWEB PRO is the supported platform and must not be exposed to the internet either (Dixell France, 2026-10-14). For an XWEB EVO that may have been accessed it gives a procedure: isolate the unit, restore the latest backup made before the access or otherwise check the users and profiles, set new passwords, check the alarm categories and recipients with a test alarm, and restore the device parameters from backup files or, without one, read each device's parameters and check setpoints, alarm thresholds and defrost parameters; it also says to check the product temperatures in the cabinets directly, since altered setpoints or alarm thresholds can compromise food safety (Dixell France, 2026-10-14).

Le Monde reports that besides raising the defrost temperature to 50 degrees the attackers lengthened the defrost operation from one hour to eight so that alarms trigger late, which delayed interventions and amplified the damage (translated from French) (Le Monde, 2026-10-12). SecurityWeek relays that detail and adds that the Paris prosecutor's office said the attack caused fires as well as food losses, that the Finance Minister put the number of affected supermarkets at about 700 of roughly 10,000, and that investigators are reportedly puzzled by the lack of a claim of responsibility or a ransom demand, citing Reuters (SecurityWeek, 2026-10-15). Cybersecurity Dive had already reported that a Copeland spokesperson confirmed the vulnerability was found in discontinued end-of-life controllers (Cybersecurity Dive, 2026-10-15).

Builds on: A hidden authentication mechanism discloses internal network layout before an attacker even… · An attacker can reconstruct admin credentials for an exposed refrigeration controller offline…

incident13 Oct 03:41Zmulti-sourceOpen finding →
Sources: CERT-FR (alert CERTFR-2026-ALE-012) · AFP · BFMTV · Infosecurity Magazine · BleepingComputer · CERT-FR (alert CERTFR-2026-ALE-012, revised version) · NCSC Switzerland (Security Hub advisory 13054) · Cooling Post · Blick · Censys · CERT-FR (alert CERTFR-2026-ALE-012, third version) · Dixell France (Copeland) · Le Monde · SecurityWeek · Cybersecurity Dive

2026-08-28 · view entry permalink →

NOTABLECVE-2025-41450 +2NATOB2

Claroty Team82: Danfoss AK-SM 800A refrigeration system managers, undocumented 'code-of-the-day' authentication bypass and post-authentication command-injection RCE across thousands of internet-exposed devices

Companion disclosure to Claroty Team82's Copeland XWEB Pro research, published the same day (2026-08-09T17:59Z), covering the Danfoss AK-SM 800A refrigeration system-manager platform used in supermarkets, cold-storage facilities and commercial HVAC. Claroty found "thousands of publicly accessible management interfaces" via internet-wide scan data, using platforms including Shodan and Censys: "to understand the real-world exposure of the Danfoss AK-SM 800A, we searched publicly available internet-wide scanning platforms" (Claroty Team82, 2026-08-09); Claroty does not publish a precise device count.

CVE-2025-41450 (CWE-287 Improper Authentication, CVSS 3.1 8.2) is a hidden, undocumented "code-of-the-day" authentication mechanism: the application accepts a specially crafted authentication request containing a generated "code of the day" that bypasses normal login and discloses a web report with internal IPs, usernames and store names, "the application accepts a specially crafted authentication request containing a generated 'code of the day'" (Claroty Team82, 2026-08-09), patched in firmware build 4.2. CVE-2025-41451 (CWE-77 OS Command Injection, CVSS 3.1 7.6) is a post-authenticated command injection in the alarm-to-email (SMTP) configuration field: a user-supplied value is formatted unsanitized into a shell command executed on the device, which Claroty used to achieve remote code execution: "the field value being formatted into the shell command is not sanitized according to our analysis and could potentially include OS shell directives that yield subsequent commands controlled by a potential attacker" (Claroty Team82, 2026-08-09). CVE-2025-41452 (CWE-15 External Control of Configuration Setting, CVSS 3.1 5.4) lets a post-authenticated user inject arbitrary Nginx directives via the exposed headers.conf include: "an attacker could abuse it to implant arbitrary routing directives into the Internet-facing Nginx configuration" (Claroty Team82, 2026-08-09), enabling denial-of-service. Danfoss shipped firmware R4.3.1 fixing CVE-2025-41451/41452 (build 4.2 for CVE-2025-41450). The RCE and Nginx-injection primitives require prior authentication; Claroty's article does not explicitly confirm the code-of-the-day mechanism as a pre-auth path into the two post-auth primitives, so this entry treats the chain as auth-gated unless a combined path is independently confirmed.

Triage: monitor authentication attempts against AK-SM 800A management interfaces for requests carrying a non-standard authentication parameter shape (a "code" field distinct from the normal username/password flow), legitimate operator logins never use the code-of-the-day mechanism, so its presence in a request is itself the discriminator. On the post-auth side, unexpected shell-metacharacter content in the alarm-email SMTP configuration field, or unexplained changes to the device's Nginx routing configuration, have no benign explanation for a device whose configuration should change only through documented administrative workflows.

The application accepts a specially crafted authentication request containing a generated 'code of the day.'

The field value being formatted into the shell command is not sanitized according to our analysis and could potentially include OS shell directives that yield subsequent commands controlled by a potential attacker.

An attacker could abuse it to implant arbitrary routing directives into the Internet-facing Nginx configuration.

To understand the real-world exposure of the Danfoss AK-SM 800A, we searched publicly available internet-wide scanning platforms.

Claroty Team82 2026-08-09
vulnerability28 Aug 06:54Zsingle-sourceOpen finding →
Sources: Claroty Team82

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1
  • Threats1

Source distribution

  • afp.com1 (7%)
  • bfmtv.com1 (7%)
  • bleepingcomputer.com1 (7%)
  • blick.ch1 (7%)
  • censys.com1 (7%)
  • cert.ssi.gouv.fr1 (7%)
  • claroty.com1 (7%)
  • coolingpost.com1 (7%)
  • other6 (43%)
All cited sources (14)