Secret Daily Passwords Expose Danfoss Supermarket Coolers

A date-generated master key in commercial freezers

The hardware in question is the Danfoss AK-SM 800A, an industrial controller responsible for regulating temperatures, scheduling defrosts, and handling alarms in food warehouses and grocery stores. Because facility managers often demand remote visibility, these boxes routinely sit connected to the public internet.

Using internet intelligence platform Censys, security firm Claroty's Team82 found 2,765 of these Danfoss units directly reachable online. What they found inside the firmware was even worse: an undocumented backdoor.

Tracked as CVE-2025-41450, the authentication routine checks an incoming credential against a string mathematically derived from the controller's current calendar date. By reverse-engineering the algorithm, the researchers could calculate the valid administrative password for any device on any day without needing the operator's actual credentials. The issue echoes broader risks in physical enterprise networks, similar to how stolen passwords expose large institutional systems when basic credential safeguards collapse.

Danfoss AK-SM 800A security details

Chaining logins to remote code execution

Bypassing the login screen is dangerous enough, but Claroty discovered that unauthorized access quickly leads to full device compromise.

Under CVE-2025-41451, the controller's email alert setup fails to sanitize input fields. An attacker who slips past the login can input shell commands into the email password field, triggering unauthenticated command execution directly on the underlying operating system.

A third vulnerability, CVE-2025-41452, targets the built-in Nginx web server. An authenticated user can rewrite the server configuration file (`headers.conf`) without restarting the machine. By pushing crafted routing directives, an attacker can crash the internal `sm_app` process into an unhandled loop, completely locking legitimate technicians out of the management interface while perishable inventory remains in jeopardy.

What operators should do right now

Danfoss has issued firmware version R4.3.1, which eliminates the daily bypass routine, patches the command injection flaw, and protects web server configurations. Facilities running AK-SM 800A controllers in the US, Europe, and international markets should update immediately.

Beyond patching, operations teams must pull these controllers off the public web entirely. Administrative portals for industrial hardware belong behind an encrypted corporate VPN or an isolated management network, never on raw, internet-routable IP addresses.

Commercial cooling controls quietly underpin the food supply chain, yet thousands remain indexed on standard search engines with backdoor logins baked into their code. Updating to firmware R4.3.1 closes the hole, but isolating industrial systems from direct internet access remains the only permanent fix.