A nightmare scenario for supermarkets: Hidden daily passwords and command injection flaws leave thousands of Danfoss supermarket systems open to remote takeover
Researchers uncovered that 2,765 publicly accessible Danfoss refrigeration controllers can be reached from the open internet, exposing supermarket cold‑chain equipment to remote hijack. If a hacker gains control, temperature settings could be altered, alarms silenced, and entire product inventories spoiled, hitting both profit margins and food safety.
Internet Exposure of Industrial Controllers
Team82 leveraged the Censys platform to scan the global address space and locate devices running the AK‑SM 800A controller, a unit that “provides centralized monitoring and configuration of refrigeration equipment.” The scan revealed thousands of instances where the web‑based management interface was left reachable without any network segmentation. Public exposure turns a tool meant for remote diagnostics into a direct entry point for attackers.
Because the interface is browser‑accessible, any operator with a web browser can connect, but the same convenience allows anyone on the internet to probe for vulnerabilities. The researchers’ methodology shows that even modest scanning tools can enumerate critical infrastructure when manufacturers default to internet‑facing deployments. This pattern repeats across many industrial IoT products, underscoring a systemic risk in supply‑chain security practices.
From a defensive standpoint, the sheer number of discoverable units forces operators to reconsider perimeter assumptions; traditional firewalls no longer suffice when devices themselves broadcast their presence. The exposure also complicates incident response, as each reachable controller represents a potential foothold that must be identified, isolated, and remediated.
Authentication Bypass via Daily Generated Code
The AK‑SM 800A contains an undocumented authentication path that validates a “daily generated access code” instead of the configured administrator password. Designated CVE-2025-41450, this flaw checks a credential against a value derived from the device’s current date, effectively creating a predictable backdoor. Researchers reverse‑engineered the firmware to reconstruct the algorithm, proving that anyone who reproduces it can obtain full admin rights without knowing the legitimate password.
This mechanism defeats the core principle of secret‑based authentication: if the secret can be derived from publicly known data (the date), it is no longer secret. The daily code acts like a master key that changes every 24 hours, but because the generation logic is static, it can be scripted and applied at scale. Attackers could therefore automate login attempts across all exposed devices, bypassing any password policies the organization has enforced.
Beyond unauthorized login, the flaw grants access to configuration settings, alarm thresholds, and schedule adjustments. In a supermarket context, this could mean silently raising temperatures to spoil perishable goods while the system reports normal operation, eroding trust in automated monitoring.
Email Configuration Flaw and Command Injection
In addition to the authentication issue, the AK‑SM 800A’s email notification subsystem contains a flaw that permits operating system command execution. The email configuration flaw allows an attacker to inject arbitrary shell commands into the email payload, which the controller then runs with system privileges. This type of command injection is especially dangerous because it bypasses the need for any further authentication once the device is reachable.
Because the controller runs a Linux‑based OS, injected commands can modify firmware, install persistent backdoors, or exfiltrate data about the refrigeration network. The vulnerability is amplified by the fact that the email service is often left enabled for alerting purposes, providing a ready‑made vector for exploitation. Once compromised, the attacker can maintain control even if the original authentication bypass is patched.
The combination of a password‑bypass and a command injection creates a two‑stage attack chain: first gain admin access via the daily code, then execute system‑level commands to entrench the foothold. This chain illustrates how seemingly isolated bugs can compound into a full‑blown remote takeover scenario.
What This Actually Means For You
- Administrative access can be obtained without a password, meaning any existing credential policies are ineffective against this specific flaw.
- Remote attackers could alter temperature set‑points, leading to product loss and potential health violations.
- The command injection enables persistent compromise, allowing malicious code to survive firmware updates if not fully re‑flashed.
- Because the devices are internet‑visible, the threat surface is global; a single unpatched controller can serve as a launchpad for attacks on other networked assets.
Immediate Action Steps
First, audit your network for any AK‑SM 800A controllers and verify whether they are reachable from the internet; if so, block inbound traffic at the firewall or move the devices behind a VPN. Second, apply the latest firmware patches released by Danfoss that address CVE‑2025‑41450 and the email injection flaw, and confirm the update by checking the firmware version via the local console.
Finally, disable the email notification feature if it is not essential, or reconfigure it to use a hardened relay that validates payloads before delivery. Regularly rotate any default credentials and monitor logs for unusual login attempts that match the daily code pattern.
Frequently Asked Questions
How many Danfoss refrigeration controllers are exposed online?
Team82 identified 2,765 publicly accessible systems using the Censys scanning platform, indicating a widespread exposure across supermarkets and cold‑storage facilities.
What is CVE‑2025‑41450 and how does it work?
The vulnerability is an undocumented authentication bypass that validates a daily generated access code derived from the device’s date, allowing attackers to gain admin rights without the legitimate password.
Can the email configuration flaw be used to execute commands remotely?
Yes, the flaw permits injection of operating system commands into the email service, which the controller executes with system privileges, enabling remote code execution.
What Do You Think?
Given the ease of discovery and exploitation, should supermarkets treat internet‑facing refrigeration controllers as high‑risk assets and prioritize their isolation over convenience?