/
← Voltar ao feed
high retail food and agriculture industrial control systems

Danfoss StoreView controllers exposed in France fall 71% after October 11 cyber-attack on supermarket refrigeration

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 10:45 · coletado há 6 horas

Censys observed a 71% drop in internet-exposed Danfoss StoreView control panels in France in three days after the October 11 cyber-attack on hundreds of French supermarkets. The attack targeted refrigeration controllers that Danfoss confirmed were mostly older models without security updates (AK-SM800, AK-SC355) or newer models on outdated firmware (AK-SM800A). Danfoss has not confirmed the initial access vector, but exploitation of unpatched, internet-exposed controllers is a plausible explanation. Censys telemetry indicates operators are taking devices offline rather than patching them.

Technical Details

  • Danfoss patched three AK-SM 800A vulnerabilities: CVE-2025-41450 (March 2025), CVE-2025-41451 and CVE-2025-41452 (August 2025).
  • A Claroty researcher later demonstrated that CVE-2025-41450 and CVE-2025-41451 can be chained for remote code execution, disabling cooling while falsifying temperature readings, which could hide cold-chain failures.
  • Censys counted 2,991 exposed StoreView hosts on October 11, of which 1,825 (61%) were in France. French hosts fell to 1,781 on October 12 and 537 on October 14. Hosts in other countries went from 1,166 to 966 over the same period.
  • All version groups (below 4.2, 4.2.4 and patched) shrank by about 70%. The share on 4.3.1 or later, which fixes all three CVEs, did not grow, so the drop reflects devices going offline and not patching.
  • On October 11, 74% of exposed French instances ran below 4.3.1. The share was higher in Poland (81%), Romania (80%) and Belgium (76%). The Netherlands still had 62 exposed unpatched instances and the US had 58. The latest StoreView version is 5.3.2.

Remediation

  • Remove StoreView and refrigeration controllers from direct internet exposure.
  • Update to StoreView 4.3.1 or later (latest 5.3.2), which fixes all three CVEs.
  • Replace end-of-life models (AK-SM800, AK-SC355) that no longer receive security updates.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 15/10/2026 10:45 · coletado 20/10 16:31 primeiro registro

    Danfoss StoreView controllers exposed in France fall 71% after October 11 cyber-attack on supermarket refrigeration

    ler a análise desta fonte

    Censys observed a 71% drop in internet-exposed Danfoss StoreView control panels in France in three days after the October 11 cyber-attack on hundreds of French supermarkets. The attack targeted refrigeration controllers that Danfoss confirmed were mostly older models without security updates (AK-SM800, AK-SC355) or newer models on outdated firmware (AK-SM800A). Danfoss has not confirmed the initial access vector, but exploitation of unpatched, internet-exposed controllers is a plausible explanation. Censys telemetry indicates operators are taking devices offline rather than patching them.

    Technical Details

    • Danfoss patched three AK-SM 800A vulnerabilities: CVE-2025-41450 (March 2025), CVE-2025-41451 and CVE-2025-41452 (August 2025).
    • A Claroty researcher later demonstrated that CVE-2025-41450 and CVE-2025-41451 can be chained for remote code execution, disabling cooling while falsifying temperature readings, which could hide cold-chain failures.
    • Censys counted 2,991 exposed StoreView hosts on October 11, of which 1,825 (61%) were in France. French hosts fell to 1,781 on October 12 and 537 on October 14. Hosts in other countries went from 1,166 to 966 over the same period.
    • All version groups (below 4.2, 4.2.4 and patched) shrank by about 70%. The share on 4.3.1 or later, which fixes all three CVEs, did not grow, so the drop reflects devices going offline and not patching.
    • On October 11, 74% of exposed French instances ran below 4.3.1. The share was higher in Poland (81%), Romania (80%) and Belgium (76%). The Netherlands still had 62 exposed unpatched instances and the US had 58. The latest StoreView version is 5.3.2.

    Remediation

    • Remove StoreView and refrigeration controllers from direct internet exposure.
    • Update to StoreView 4.3.1 or later (latest 5.3.2), which fixes all three CVEs.
    • Replace end-of-life models (AK-SM800, AK-SC355) that no longer receive security updates.