Widespread remote manipulation of supermarket refrigeration controllers in France and other EU countries
On October 11 attackers remotely switched refrigeration units into defrost mode at hundreds of supermarkets in France, raising temperatures up to 50 °C and spoiling stock, in an incident CERT-FR links to internet-exposed remote management controllers. The campaign affected an estimated ~700 stores (Les Mousquetaires/Intermarché reported significant losses) and later spread to Belgium, Sweden, Ireland and the Netherlands; investigators have opened criminal inquiries and warnings remain that compromises may be ongoing (industrialcyber.co). CERT-FR named compromised device families including Danfoss AK-SM / AK-SC controllers and Copeland / Dixell XWEB supervisors, and the reporting cites prior research by Claroty Team82 (industrialcyber.co). The vendor Danfoss told reporters affected stores ran outdated firmware; one Danfoss authentication-bypass CVE is cited in the article as CVE-2025-41450 and Danfoss published fixes in firmware versions 4.2 and 4.3.1 according to the reporting (industrialcyber.co).
Entenda a falha
A vulnerabilidade
CVE-2025-41450 is an authentication bypass in the Danfoss AK-SM 800A controller, found by Claroty Team82. It relies on a hidden daily code derived from the device's date. An attacker only needs network reach to an exposed management interface and gets access without valid credentials. Danfoss fixed it in firmware 4.2 (March 2025); two post-authentication flaws, including a command injection, were fixed in 4.3.1 (August 2025). Neither CERT-FR nor Danfoss has confirmed that this CVE was used in the French attacks. End-of-life models (AK-SM 800, AK-SC 355) cannot be fixed.
Como funciona
The controller exposes a management interface that technicians use remotely to adjust settings such as defrost schedules. When a login request arrives, the device is supposed to check the credentials. In the flawed logic, a code derived from the device's current date is accepted as proof of access, so the check can be passed without a real password. Once inside, an attacker can change defrost schedules, which is what was seen in the supermarket incidents.
Por que é vulnerável
The root cause is a hidden authentication mechanism whose secret is predictable: a daily code derived from the device date, which is not a real secret. The fix in version 4.2 addresses this bypass. Impact was worsened by deployment practices: controllers exposed to the internet, outdated or end-of-life firmware, and default passwords (Danfoss said this about the Dutch incidents).
Como foi descoberta
Claroty Team82 disclosed three flaws in the AK-SM 800A, including CVE-2025-41450, and Danfoss shipped fixes in 4.2 and 4.3.1 in 2025. The attacks themselves came to light on October 11, when refrigeration units in French supermarkets were switched into defrost mode, and CERT-FR issued alert CERTFR-2026-ALE-012 on October 12. No group has claimed them and the entry route has not been disclosed. Similar incidents followed on November 2 in Belgium, Sweden, Ireland and the Netherlands.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The article says Claroty Team82 showed that AI tools could rebuild exploits for the Danfoss controller flaws in 28 minutes, and researcher Kevin Beaumont called exploitation a zero-skill thing. No article says an exploit was published, so it is treated as not public. Given how easy exploitation is said to be and the thousands of exposed devices, patching or isolating them is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 12:31.
Detalhes técnicos
- CERT-FR alert CERTFR-2026-ALE-012 reported numerous compromises of Danfoss AK-SM and AK-SC series controllers and Copeland / Dixell XWEB supervisors and advised removal of direct internet exposure, use of VPNs, firmware updates and password changes (industrialcyber.co).
- Reported affected models included end-of-life or outdated units such as AK-SM 800, AK-SC 355 and AK-SM 800A; journalists and researchers observed large numbers of internet-facing Danfoss controller interfaces (article cites Shodan counts of >4,500) (industrialcyber.co).
- The article references Claroty Team82 disclosures including CVE-2025-41450 (an authentication bypass) and notes Danfoss' fixes: CVE-2025-41450 addressed in firmware v4.2 (Mar 2025) and additional post-authentication/command-injection fixes in v4.3.1 (Aug 2025) (industrialcyber.co).
- Attack behaviour: remote toggling of defrost schedules on refrigeration controllers, raising temperatures to spoil food and creating fire risk; attackers did not require access to corporate networks but used publicly reachable device management interfaces or credentials exposed to the internet (industrialcyber.co). The same pattern was later observed in multiple European countries (industrialcyber.co).
Detalhes da correção
- The article reports that Danfoss released fixes: firmware v4.2 addressed an authentication-bypass (CVE-2025-41450) and v4.3.1 addressed additional post-authentication issues including a command-injection vector; affected operators running obsolete or end-of-life firmware cannot be protected by firmware updates and require architectural mitigations (industrialcyber.co).
Remediação
- Remove direct internet exposure of industrial controllers; restore remote maintenance access behind secure VPNs or protected management networks, segment OT from other networks, update device firmware where updates exist, and change default credentials (industrialcyber.co).
- Note that for end-of-life devices without available fixes a factory reset may not suffice; operators should plan replacement or compensating controls such as network isolation and vendor-assisted secure management (industrialcyber.co).
Linha do tempo
-
Widespread remote manipulation of supermarket refrigeration controllers in France and other EU countries
ler a análise desta fonte ocultar
On October 11 attackers remotely switched refrigeration units into defrost mode at hundreds of supermarkets in France, raising temperatures up to 50 °C and spoiling stock, in an incident CERT-FR links to internet-exposed remote management controllers. The campaign affected an estimated ~700 stores (Les Mousquetaires/Intermarché reported significant losses) and later spread to Belgium, Sweden, Ireland and the Netherlands; investigators have opened criminal inquiries and warnings remain that compromises may be ongoing (industrialcyber.co). CERT-FR named compromised device families including Danfoss AK-SM / AK-SC controllers and Copeland / Dixell XWEB supervisors, and the reporting cites prior research by Claroty Team82 (industrialcyber.co). The vendor Danfoss told reporters affected stores ran outdated firmware; one Danfoss authentication-bypass CVE is cited in the article as CVE-2025-41450 and Danfoss published fixes in firmware versions 4.2 and 4.3.1 according to the reporting (industrialcyber.co).
Technical Details
- CERT-FR alert CERTFR-2026-ALE-012 reported numerous compromises of Danfoss AK-SM and AK-SC series controllers and Copeland / Dixell XWEB supervisors and advised removal of direct internet exposure, use of VPNs, firmware updates and password changes (industrialcyber.co).
- Reported affected models included end-of-life or outdated units such as AK-SM 800, AK-SC 355 and AK-SM 800A; journalists and researchers observed large numbers of internet-facing Danfoss controller interfaces (article cites Shodan counts of >4,500) (industrialcyber.co).
- The article references Claroty Team82 disclosures including CVE-2025-41450 (an authentication bypass) and notes Danfoss' fixes: CVE-2025-41450 addressed in firmware v4.2 (Mar 2025) and additional post-authentication/command-injection fixes in v4.3.1 (Aug 2025) (industrialcyber.co).
- Attack behaviour: remote toggling of defrost schedules on refrigeration controllers, raising temperatures to spoil food and creating fire risk; attackers did not require access to corporate networks but used publicly reachable device management interfaces or credentials exposed to the internet (industrialcyber.co). The same pattern was later observed in multiple European countries (industrialcyber.co).
Fix Details
- The article reports that Danfoss released fixes: firmware v4.2 addressed an authentication-bypass (CVE-2025-41450) and v4.3.1 addressed additional post-authentication issues including a command-injection vector; affected operators running obsolete or end-of-life firmware cannot be protected by firmware updates and require architectural mitigations (industrialcyber.co).
Remediation
- Remove direct internet exposure of industrial controllers; restore remote maintenance access behind secure VPNs or protected management networks, segment OT from other networks, update device firmware where updates exist, and change default credentials (industrialcyber.co).
- Note that for end-of-life devices without available fixes a factory reset may not suffice; operators should plan replacement or compensating controls such as network isolation and vendor-assisted secure management (industrialcyber.co).