Danfoss refrigeration controllers expose hidden daily password and command injection

Claroty's Team82 found three flaws in Danfoss AK-SM 800A refrigeration controllers: an undocumented daily code bypasses the admin password, an email configuration flaw enables OS command injection, and an Nginx misconfiguration can disrupt the web interface. Censys found 2,765 publicly accessible systems; Danfoss released firmware R4.3.1.

• 2,765 Danfoss controllers were exposed to the internet
• CVE-2025-41450: daily code bypasses admin password
• CVE-2025-41451: command injection via email settings
• Fix: firmware R4.3.1 and restricted admin access