Forescout: 6,017 internet-exposed refrigeration controllers in 99 countries; 700+ French supermarkets hit by temperature manipulation
Forescout's Vedere Labs identified 12,976 internet-exposed service observations tied to refrigeration management systems across 6,017 public IP addresses in 99 countries and territories. In October 2026, CERT-FR confirmed that incidents at more than 700 French supermarkets involved Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB systems. Attackers changed temperature and defrost controls, causing food losses. Initial access, exploited vulnerabilities, attacker infrastructure, persistence and attribution remain unconfirmed. Since January 2026, Forescout has also tracked more than 20 claimed hacktivist attacks on refrigeration systems, with pro-Russian groups Z-Pentest Alliance and NoName057(16) among the most active.
Entenda a falha
A vulnerabilidade
Forescout's Vedere Labs ties CVE-2025-41451 and CVE-2025-41452 to Danfoss AK-SM 800A firmware older than 4.3.1, used in refrigeration management systems. The articles do not describe the flaw type, the component, the attacker requirements, the impact or the fixed version beyond 4.3.1. Forescout counted 3,762 StoreView observations (80% of the AK-SM 800A total) on affected firmware, but firmware versions are often not visible, so it could not confirm which exposed services are vulnerable. Separately, the more-than-700 French supermarket incidents (CERT-FR: Danfoss AK-SM/AK-SC, Copeland and Dixell XWEB) have no confirmed initial access or exploited vulnerability. Weak or missing authentication is the other exposure path. The AK-SM 800 targeted in France is end-of-life and cannot be patched.
Como funciona
The articles do not explain how the two CVEs work internally. What they describe is the attack pattern on exposed systems: an attacker reaches a refrigeration management interface (such as an HMI or web supervisor) directly from the internet, gets in through weak or missing credentials or possibly a known flaw, and then uses legitimate supervisory functions to change temperature setpoints and defrost schedules. Rapid successive configuration changes suggest automation. No destructive malware is needed, so the malicious changes can look like routine activity.
Por que é vulnerável
For the two CVEs, the articles give no root cause. The broader exposure comes from management interfaces published directly on the internet, with authentication that is sometimes missing or weak (only 287 of 513 pCOWeb services returned HTTP 401), and from end-of-life models that cannot receive patches. Forescout notes that manufacturer deployment documentation supported remote connectivity. Updating to firmware 4.3.1 or later is the implied fix for the AK-SM 800A, but the articles do not say what it changes.
Como foi descoberta
The findings come from Forescout's Vedere Labs, which analyzed internet-exposed asset data (12,976 service observations, 6,017 public IPs, 99 countries) and published the results in a blog post on Thursday, October 22, 2026. The articles do not say who found CVE-2025-41451 and CVE-2025-41452 or how they were reported. The French incidents were investigated by French authorities and incident responders, and CERT-FR confirmed the affected product families. Forescout also tracked more than 20 claimed hacktivist attacks since January 2026, with Z-Pentest Alliance and NoName057(16) among the most active.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 10:19.
Detalhes técnicos
- The exposed services span 10 product groups, including Copeland/Dixell XWEB, Danfoss StoreView, Copeland Site Supervisor and Carel pCOWeb.
- The attacks abuse legitimate supervisory functions, so no destructive malware is needed. Rapid successive configuration changes suggest automation.
- Attack path 1, weak or missing authentication: only 287 of 513 pCOWeb services returned HTTP 401. Credentials may also be weak or bought from other attackers.
- Attack path 2, known vulnerabilities: some models, such as the Danfoss AK-SM 800 targeted in France, are end-of-life and cannot be patched. 3,762 StoreView observations (80% of Danfoss AK-SM 800A) run firmware older than 4.3.1, which is affected by CVE-2025-41451 and CVE-2025-41452. Firmware versions are often not visible, so applicability per service could not be confirmed.
- Hacktivist targets were mainly fruit storage, wineries, supermarkets and food processing in Spain, Italy and elsewhere in Europe, through exposed HMIs. On April 26, Z-Pentest claimed 10 attacks in a single day.
- Hospitals and agricultural facilities that use similar cooling equipment are also at risk.
Remediação
- Remove direct public internet access to refrigeration management interfaces and use secure remote-access gateways.
- Patch supported devices and replace unsupported ones.
- Eliminate shared or stale contractor credentials. Require named identities, MFA, least privilege and session logging.
- Inventory the full control path, including public IPs, port forwarding, NAT, VPNs and supervisory platforms.
- Monitor and correlate remote sessions with changes to setpoints, defrost schedules, alarms and users, using IoT/OT-aware network monitoring.
Linha do tempo
-
Forescout: 6,017 internet-exposed refrigeration controllers in 99 countries; 700+ French supermarkets hit by temperature manipulation
ler a análise desta fonte ocultar
Forescout's Vedere Labs identified 12,976 internet-exposed service observations tied to refrigeration management systems across 6,017 public IP addresses in 99 countries and territories. In October 2026, CERT-FR confirmed that incidents at more than 700 French supermarkets involved Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB systems. Attackers changed temperature and defrost controls, causing food losses. Initial access, exploited vulnerabilities, attacker infrastructure, persistence and attribution remain unconfirmed. Since January 2026, Forescout has also tracked more than 20 claimed hacktivist attacks on refrigeration systems, with pro-Russian groups Z-Pentest Alliance and NoName057(16) among the most active.
Technical Details
- The exposed services span 10 product groups, including Copeland/Dixell XWEB, Danfoss StoreView, Copeland Site Supervisor and Carel pCOWeb.
- The attacks abuse legitimate supervisory functions, so no destructive malware is needed. Rapid successive configuration changes suggest automation.
- Attack path 1, weak or missing authentication: only 287 of 513 pCOWeb services returned HTTP 401. Credentials may also be weak or bought from other attackers.
- Attack path 2, known vulnerabilities: some models, such as the Danfoss AK-SM 800 targeted in France, are end-of-life and cannot be patched. 3,762 StoreView observations (80% of Danfoss AK-SM 800A) run firmware older than 4.3.1, which is affected by CVE-2025-41451 and CVE-2025-41452. Firmware versions are often not visible, so applicability per service could not be confirmed.
- Hacktivist targets were mainly fruit storage, wineries, supermarkets and food processing in Spain, Italy and elsewhere in Europe, through exposed HMIs. On April 26, Z-Pentest claimed 10 attacks in a single day.
- Hospitals and agricultural facilities that use similar cooling equipment are also at risk.
Remediation
- Remove direct public internet access to refrigeration management interfaces and use secure remote-access gateways.
- Patch supported devices and replace unsupported ones.
- Eliminate shared or stale contractor credentials. Require named identities, MFA, least privilege and session logging.
- Inventory the full control path, including public IPs, port forwarding, NAT, VPNs and supervisory platforms.
- Monitor and correlate remote sessions with changes to setpoints, defrost schedules, alarms and users, using IoT/OT-aware network monitoring.