GoKawiilNew RCE flaws found in patched Danfoss AK-SM800A refrigeration controllers
Security researchers examined the latest Danfoss AK-SM800A firmware (version 5.3.2) after a wave of attacks on exposed refrigeration controllers that began in France on October 11th, and found multiple new remote code execution vulnerabilities despite prior patches. Earlier flaws in Danfoss AK-SM800, AK-SM800A and AK-EM100 systems, including an authentication bypass and command injection bugs, had already been publicly documented and exploited, with proof-of-concept code appearing within 48 hours of the attacks. Data from Censys shows hundreds of Danfoss systems and over a thousand Copeland and Dixell controllers remain exposed to the internet.
GoKawiil's interpretation of the reporting above, not reported fact.
The discovery of fresh RCE bugs in already-patched firmware suggests that applying vendor patches alone does not resolve the underlying insecurity of these industrial refrigeration controllers, according to the researchers. Many organizations, such as supermarket chains, keep these systems internet-facing for remote maintenance reasons tied to SLAs or insurance requirements, which could leave critical cold-chain infrastructure persistently vulnerable to attack. The pattern points to a broader industry risk: niche industrial control vendors may continue shipping products with systemic security weaknesses even after public disclosure and exploitation.
- Researchers found new remote code execution vulnerabilities in the latest Danfoss AK-SM800A firmware (5.3.2), even after prior patches.
- Earlier Danfoss vulnerabilities, including an authentication bypass and injection flaws, were already exploited in attacks starting October 11th in France.
- Censys data shows hundreds of Danfoss and over 1,000 Copeland/Dixell refrigeration controllers remain exposed online despite known risks.
Source: midnightblue.nl, 2026-11-11
Published there as: “Multiple remote code execution vulnerabilities in danfoss sm-800A”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.