Unpatched Danfoss refrigeration controllers hijacked for cold-chain sabotage in France and Europe
Danfoss refrigeration controllers exposed to the public Internet were manipulated between 11 and 13 October 2026 in a campaign that hit hundreds of French supermarkets, including stores of Intermarché and Coopérative U, causing food spoilage and business interruption. A second wave on the night of 1-2 November reached refrigeration systems in about a dozen European countries and set cold rooms at three sites of the French Blood Establishment to 110°C before staff intervened. On 9 November 2026 French authorities attributed the operation to the IRGC unit 'Shahid Kaveh', which the article links to CyberAveng3rs. Sekoia assesses the alleged NoName057(16) / Z-Pentest claim as unsubstantiated and describes the campaigns as unsophisticated, relying on direct exposure of unpatched controllers rather than on a code execution flaw.
Entenda a falha
A vulnerabilidade
CVE-2025-41450 is the 'code of the day' authentication bypass in the web interface of Danfoss AK-SM 800A / 8xxA refrigeration controllers. An unauthenticated attacker who can reach the interface over the network can get full access to the device's API endpoints. Affected firmware is earlier than R4.2 (per CISA, as relayed by cybersecuritynews.com), and R4.2 is the fixed release. Sekoia could not confirm that this CVE was used in the October campaign. It also saw a blocked attempt at a separate, non-public flaw that lets an unauthenticated caller rename a user account by its numeric ID.
Como funciona
The controller's web interface accepts XML requests at the xml.cgi endpoint, with actions such as read_units and read_date_time. For authentication, the device compares the first five characters of the password attribute in the request with a numeric code it generates from its current date. If they match, it grants access even without a valid username. That is why an attacker first needs the device date, which read_date_time can return. In the second flaw, a request carrying a numeric user ID makes the device rename that account without checking who is asking. Sekoia suspects this is the first step of a password-reset chain.
Por que é vulnerável
In CVE-2025-41450 the authentication logic trusts a predictable value, a code derived from the device date, as proof of identity, and it skips the username check when that code matches. The rename flaw lacks an authentication and authorization check on an account-modification request. The articles do not describe the vendor's fix beyond R4.2 being the fixed release. Sekoia says most exposed instances ran outdated firmware, and that direct Internet exposure of the controllers was the main problem exploited.
Onde está
The affected component is the xml.cgi endpoint of the Danfoss AK-SM 800A / 8xxA web interface; the articles name no source file, function or fixing commit.
Como foi descoberta
CVE-2025-41450 was disclosed in August by Team82 of Claroty, according to Sekoia. The campaigns themselves came to light through their effects on French supermarkets in October and across Europe on 1-2 November. Sekoia then added honeypot data, deployed on 12 October, and closed-source intelligence. Its honeypots caught the rename attempt on 1 November from 178.83.226[.]215 and 37.16.75[.]128. After that, Sekoia gave an LLM (GLM 5.3) the Danfoss firmware images and the captured request, and the model confirmed the rename primitive within minutes. French authorities attributed the operation to the IRGC on 9 November; Sekoia doubts the NoName057(16) / Z-Pentest claim.
PoC pública
The articles show that exploitation happened in the wild: the campaigns changed temperature, defrost and alarm settings, and a rename request was captured on 1 November (blocked on the honeypots). The story also cites a third-party PoC repository, fromagegate, only for its table of fixed versions (R4.3.1 addresses further flaws in the family). The articles do not describe what that repository demonstrates, how mature it is, or whether it covers CVE-2025-41450. With attacks already seen against exposed controllers, patching and removing Internet exposure are urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 16:21.
Detalhes técnicos
- Exposure: Sekoia counted more than 2,700 Danfoss systems exposed worldwide on 11 October, about 1,700 of them in France, using Censys. By 16:00 on 12 October roughly half the French devices were no longer reachable; the article attributes this to victim remediation, since closed-source intelligence indicated that only control parameters were changed.
- Manipulation: the actor automatically altered temperature settings, defrost cycles and alarm thresholds to delay detection by maintenance staff for several hours, without exploiting a code execution flaw. The article reports, citing multiple unnamed sources, that setpoints were raised from 50° to 80°, causing a fire in at least one instance.
- Reconnaissance and password spraying: Sekoia honeypots (four Danfoss 800A web interfaces in France and the Netherlands, deployed 12 October) received unauthenticated read_units requests on 13 October, which can expose unit identities and store locations. Later requests to the xml.cgi endpoint came from 26 unique IP addresses, combining read_units and read_date_time reconnaissance with password spraying against the Supervisor and admin accounts using '12345'.
- Suspected authentication bypass: CVE-2025-41450 (the 'code of the day' flaw) derives an accepted code from the device date. The article could not confirm its use in the first campaign, but notes that read_date_time probing between 19 and 25 October may be a prelude. CISA's advisory, as relayed by cybersecuritynews.com, lists affected AK-SM 8xxA versions as those earlier than R4.2.
- Second-wave exploit attempt: on 1 November, between 22:00 and 22:30, a blocked request aimed at a non-public flaw tried to rename a user account by numeric ID. It came from 178.83.226[.]215 and 37.16.75[.]128 against four honeypots, and targeted ID 1, an administrator account. The article suspects it is the first step of a password-reset chain, whose second request was not captured.
- LLM-assisted analysis: Sekoia states that an LLM, given Danfoss firmware images and a captured HAR file, confirmed the rename primitive within minutes, and argues that this lowers the barrier for exploit development against small ICS and building automation devices.
Remediação
- Remove refrigeration controllers from direct Internet exposure and restrict remote administration through secure access mechanisms.
- Replace default credentials and monitor authentication and configuration changes.
- Apply firmware updates: for CVE-2025-41450, R4.2 is the fixed AK-SM 8xxA release (cybersecuritynews.com, citing CISA). A later release, R4.3.1, addresses further flaws in the same family, according to a third-party PoC repository's table (github.com/msuiche/fromagegate). Neither the article nor the pages opened identify a Danfoss advisory for the 2026 campaign.
- Sekoia's TDR team continues to monitor the exposed ecosystem with honeypots that replicate the observed controller configurations.
Relatos divergentes
- Exposure counts: the article reports more than 2,700 exposed systems worldwide on 11 October (Censys). cybersecuritynews.com, dated 13 October, reports 4,980 hosts from a Shodan search, with France accounting for more than half. The two figures come from different tools and dates and cannot be reconciled directly.
- Temperature: the article's 80°C figure comes from unnamed sources and is not confirmed by a primary source the analysis opened.
Linha do tempo
-
Unpatched Danfoss refrigeration controllers hijacked for cold-chain sabotage in France and Europe
ler a análise desta fonte ocultar
Danfoss refrigeration controllers exposed to the public Internet were manipulated between 11 and 13 October 2026 in a campaign that hit hundreds of French supermarkets, including stores of Intermarché and Coopérative U, causing food spoilage and business interruption. A second wave on the night of 1-2 November reached refrigeration systems in about a dozen European countries and set cold rooms at three sites of the French Blood Establishment to 110°C before staff intervened. On 9 November 2026 French authorities attributed the operation to the IRGC unit 'Shahid Kaveh', which the article links to CyberAveng3rs. Sekoia assesses the alleged NoName057(16) / Z-Pentest claim as unsubstantiated and describes the campaigns as unsophisticated, relying on direct exposure of unpatched controllers rather than on a code execution flaw.
Technical Details
- Exposure: Sekoia counted more than 2,700 Danfoss systems exposed worldwide on 11 October, about 1,700 of them in France, using Censys. By 16:00 on 12 October roughly half the French devices were no longer reachable; the article attributes this to victim remediation, since closed-source intelligence indicated that only control parameters were changed.
- Manipulation: the actor automatically altered temperature settings, defrost cycles and alarm thresholds to delay detection by maintenance staff for several hours, without exploiting a code execution flaw. The article reports, citing multiple unnamed sources, that setpoints were raised from 50° to 80°, causing a fire in at least one instance.
- Reconnaissance and password spraying: Sekoia honeypots (four Danfoss 800A web interfaces in France and the Netherlands, deployed 12 October) received unauthenticated read_units requests on 13 October, which can expose unit identities and store locations. Later requests to the xml.cgi endpoint came from 26 unique IP addresses, combining read_units and read_date_time reconnaissance with password spraying against the Supervisor and admin accounts using '12345'.
- Suspected authentication bypass: CVE-2025-41450 (the 'code of the day' flaw) derives an accepted code from the device date. The article could not confirm its use in the first campaign, but notes that read_date_time probing between 19 and 25 October may be a prelude. CISA's advisory, as relayed by cybersecuritynews.com, lists affected AK-SM 8xxA versions as those earlier than R4.2.
- Second-wave exploit attempt: on 1 November, between 22:00 and 22:30, a blocked request aimed at a non-public flaw tried to rename a user account by numeric ID. It came from 178.83.226[.]215 and 37.16.75[.]128 against four honeypots, and targeted ID 1, an administrator account. The article suspects it is the first step of a password-reset chain, whose second request was not captured.
- LLM-assisted analysis: Sekoia states that an LLM, given Danfoss firmware images and a captured HAR file, confirmed the rename primitive within minutes, and argues that this lowers the barrier for exploit development against small ICS and building automation devices.
Remediation
- Remove refrigeration controllers from direct Internet exposure and restrict remote administration through secure access mechanisms.
- Replace default credentials and monitor authentication and configuration changes.
- Apply firmware updates: for CVE-2025-41450, R4.2 is the fixed AK-SM 8xxA release (cybersecuritynews.com, citing CISA). A later release, R4.3.1, addresses further flaws in the same family, according to a third-party PoC repository's table (github.com/msuiche/fromagegate). Neither the article nor the pages opened identify a Danfoss advisory for the 2026 campaign.
- Sekoia's TDR team continues to monitor the exposed ecosystem with honeypots that replicate the observed controller configurations.
Relatos divergentes
- Exposure counts: the article reports more than 2,700 exposed systems worldwide on 11 October (Censys). cybersecuritynews.com, dated 13 October, reports 4,980 hosts from a Shodan search, with France accounting for more than half. The two figures come from different tools and dates and cannot be reconciled directly.
- Temperature: the article's 80°C figure comes from unnamed sources and is not confirmed by a primary source the analysis opened.