Six pre-authentication zero-day RCE vulnerabilities found in Danfoss AK-SM800A refrigeration controllers enabling remote root access
Researcher Carlo Meijer of Midnight Blue discovered six zero-day vulnerabilities allowing remote code execution without authentication in Danfoss AK-SM800A refrigeration controllers, affecting all firmware versions up to 5.3.2. These exploitable flaws permit attackers to execute commands as root, including triggering defrost cycles that have led to spoiled food and fires in attacks observed in France since October 2026. The controllers run a Danux OS on i.MX6 processors without common exploit mitigations like stack canaries or PIE, and do not utilize secure boot, allowing implanted malware to survive factory resets or firmware updates. The vulnerabilities severely undermine device security despite Danfoss business units holding IEC 62443-4-1 certifications. Coordinated disclosure with Danfoss is ongoing with CVEs pending. CISA and FBI have issued warnings about attacks on such industrial refrigeration systems, highlighting risks beyond Europe. Asset owners are advised to restrict management access via VPNs or IP allowlists as interim mitigation.
Entenda a falha
A vulnerabilidade
Six pre-authentication remote code execution zero-days affect the Danfoss AK-SM800A refrigeration controller, in all firmware versions up to and including 5.3.2. An attacker who can reach the device's web interface needs no credentials and gets code execution as root. At least five are memory-corruption bugs in unauthenticated handlers of the web task in sm_app. The sixth is in sm_fcgi_app and works even in the "strict" session control mode, the default since version 4.0. No CVEs are assigned yet and no fixed version is mentioned.
Como funciona
The device runs Danux, a Yocto-based Linux, on an i.MX6 processor. Its sm_app is a monolithic binary that handles most functions, including the web task. A request sent to an unauthenticated CGI endpoint reaches handlers that copy input with unsafe strcpy calls. When the input is oversized or crafted, memory is corrupted; in testing a single request caused a segmentation fault. Because the application runs as root, taking over its execution gives full control. The sixth bug sits in the session-handling component that enforces strict mode, so that mode does not stop it.
Por que é vulnerável
The root cause is unsafe memory handling: hundreds of strcpy calls in unauthenticated handlers, with no bounds checking. Exploitation is made easier because the binaries lack stack canaries and PIE, and the vulnerable application runs as root. The controllers also do not use the i.MX6 secure boot features, so an implant can survive a factory reset or firmware update. Midnight Blue notes that Danfoss business units hold IEC 62443-4-1 certification despite this. The articles do not describe a fix.
Onde está
The articles name the web task in the sm_app binary (unauthenticated CGI handlers) and the sm_fcgi_app binary (strict session control mode); the specific endpoints are withheld during coordinated disclosure.
Como foi descoberta
Carlo Meijer of Midnight Blue found the flaws in under an hour of manual firmware review, emulating the firmware in user space with QEMU and focusing on the web task in sm_app. Disclosure to Danfoss is coordinated and still ongoing, CVE IDs are pending, and endpoint details are withheld. Separately, attacks on internet-exposed Danfoss and Copeland controllers began in France on October 11, with a second wave on November 2. The articles do not say these attacks used the six new flaws; earlier flaws in these products had been documented by Synacktiv, Claroty and DIVD.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 06:16.
Linha do tempo
-
Six pre-authentication zero-day RCE vulnerabilities found in Danfoss AK-SM800A refrigeration controllers enabling remote root access
ler a análise desta fonte ocultar
Researcher Carlo Meijer of Midnight Blue discovered six zero-day vulnerabilities allowing remote code execution without authentication in Danfoss AK-SM800A refrigeration controllers, affecting all firmware versions up to 5.3.2. These exploitable flaws permit attackers to execute commands as root, including triggering defrost cycles that have led to spoiled food and fires in attacks observed in France since October 2026. The controllers run a Danux OS on i.MX6 processors without common exploit mitigations like stack canaries or PIE, and do not utilize secure boot, allowing implanted malware to survive factory resets or firmware updates. The vulnerabilities severely undermine device security despite Danfoss business units holding IEC 62443-4-1 certifications. Coordinated disclosure with Danfoss is ongoing with CVEs pending. CISA and FBI have issued warnings about attacks on such industrial refrigeration systems, highlighting risks beyond Europe. Asset owners are advised to restrict management access via VPNs or IP allowlists as interim mitigation.