GoKawiilNew RCE flaws found in patched Danfoss AK-SM800A refrigeration controllers
Security researchers examined the latest Danfoss AK-SM800A firmware (version 5.3.2) after a wave of attacks on exposed refrigeration controllers that began in France on October 11th, and found multiple new remote code execution vulnerabilities despite prior patches. Earlier flaws in Danfoss AK-SM800, AK-SM800A and AK-EM100 systems, including an authentication bypass and command injection bugs, had already been publicly documented and exploited, with proof-of-concept code appearing within 48 hours of the attacks. Data from Censys shows hundreds of Danfoss systems and over a thousand Copeland and Dixell controllers remain exposed to the internet.