Claroty Team82: Danfoss AK-SM 800A refrigeration system managers — undocumented 'code-of-the-day' authentication bypass and post-authentication command-injection RCE across thousands of internet-exposed devices
Companion disclosure to Claroty Team82's Copeland XWEB Pro research, published the same day (2026-08-09T17:59Z), covering the Danfoss AK-SM 800A refrigeration system-manager platform used in supermarkets, cold-storage facilities and commercial HVAC. Claroty found "thousands of publicly accessible management interfaces" via internet-wide scan data, using platforms including Shodan and Censys: "to understand the real-world exposure of the Danfoss AK-SM 800A, we searched publicly available internet-wide scanning platforms" (Claroty Team82, 2026-08-09) — Claroty does not publish a precise device count.
CVE-2025-41450 (CWE-287 Improper Authentication, CVSS 3.1 8.2) is a hidden, undocumented "code-of-the-day" authentication mechanism: the application accepts a specially crafted authentication request containing a generated "code of the day" that bypasses normal login and discloses a web report with internal IPs, usernames and store names — "the application accepts a specially crafted authentication request containing a generated 'code of the day'" (Claroty Team82, 2026-08-09) — patched in firmware build 4.2. CVE-2025-41451 (CWE-77 OS Command Injection, CVSS 3.1 7.6) is a post-authenticated command injection in the alarm-to-email (SMTP) configuration field: a user-supplied value is formatted unsanitized into a shell command executed on the device, which Claroty used to achieve remote code execution: "the field value being formatted into the shell command is not sanitized and could include OS shell directives controlled by an attacker" (Claroty Team82, 2026-08-09). CVE-2025-41452 (CWE-15 External Control of Configuration Setting, CVSS 3.1 5.4) lets a post-authenticated user inject arbitrary Nginx directives via the exposed headers.conf include: "an attacker could abuse it to implant arbitrary routing directives into the Internet-facing Nginx configuration" (Claroty Team82, 2026-08-09), enabling denial-of-service. Danfoss shipped firmware R4.3.1 fixing CVE-2025-41451/41452 (build 4.2 for CVE-2025-41450). The RCE and Nginx-injection primitives require prior authentication; Claroty's article does not explicitly confirm the code-of-the-day mechanism as a pre-auth path into the two post-auth primitives, so this entry treats the chain as auth-gated unless a combined path is independently confirmed.
The undocumented authentication mechanism is instructive tradecraft on its own terms even setting aside the RCE chain: a hidden authentication bypass disclosing internal network topology (IPs, usernames, store identifiers) before an attacker needs any further vulnerability is exactly the class of vendor-authentication-mechanism audit finding that a Tier 2/3 responder auditing an OT/building-management estate should be watching for, distinct from a conventional missing-authentication bug. Triage: monitor authentication attempts against AK-SM 800A management interfaces for requests carrying a non-standard authentication parameter shape (a "code" field distinct from the normal username/password flow) — legitimate operator logins never use the code-of-the-day mechanism, so its presence in a request is itself the discriminator. On the post-auth side, unexpected shell-metacharacter content in the alarm-email SMTP configuration field, or unexplained changes to the device's Nginx routing configuration, have no benign explanation for a device whose configuration should change only through documented administrative workflows.
The application accepts a specially crafted authentication request containing a generated 'code of the day.'
The field value being formatted into the shell command is not sanitized and could include OS shell directives controlled by an attacker.
An attacker could abuse it to implant arbitrary routing directives into the Internet-facing Nginx configuration.
To understand the real-world exposure of the Danfoss AK-SM 800A, we searched publicly available internet-wide scanning platforms.
Defender actions
- Upgrade Danfoss AK-SM 800A refrigeration system managers to firmware R4.3.1 (build 4.2 closes CVE-2025-41450 alone) on every deployment, and treat any of the thousands of internet-exposed devices Claroty found via public internet-scan platforms as a priority — take management interfaces off the public internet entirely where the upgrade cannot happen immediately.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.