Six pre-authentication remote code execution flaws were found in the Danfoss AK-SM800A supermarket fridge controller, allowing remote takeover in about an hour, according to Midnight Blue researcher Carlo Meijer.
The flaws are stack-based buffer overflows. They affect every firmware version up to and including 5.3.2, and no CVE numbers have been assigned yet.
Since October 11, waves of cyber attacks have hit internet-exposed Danfoss and Copeland fridge controllers across Europe. Attackers started defrost cycles, and the losses reached tens of millions of euros.
Some stores even had fires, according to Wikipedia’s incident summary. Cyber Security News has followed the story from the start, including its report on the 4,980 exposed Danfoss hosts.
Who is behind the incidents is still debated. France has blamed Iran’s Shahid Kaveh unit, but SentinelOne says attribution remains open and the incidents may not share one operator. The French agency ANSSI also said its early findings pointed to exposed admin pages and weak passwords, not the older published bugs.
Meijer did not use fuzzing or AI. He downloaded the public firmware, ran the main program in an emulator, and looked for places where the code calls strcpy.
This old C function copies data without checking its size, so a long input can overflow memory. One unauthenticated web handler crashed after he sent a long string of “A” characters. He found at least five bugs of this kind in a small part of the code.
The binary also lacked stack canaries and PIE, two basic protections that make such bugs harder to use. The program runs as root, so a successful exploit gives full control.
Supermarket Fridge Controller Takeover
Midnight Blue showed a working root exploit on an older firmware version. The team is withholding technical details while it works with Danfoss on coordinated disclosure.
Danfoss added session control in later firmware, and “strict” became the default from version 4.0. This setting blocks most of the web attack surface for unauthenticated users, and CERT-FR lists it among its official mitigations.
Even so, the researchers found another overflow in sm_fcgi_app, the component that checks logins, and it still works on the latest firmware with strict mode on.
The team also warns about what comes after a break-in. The controller does not use the i.MX6 chip’s secure boot features. An attacker with root access could therefore plant an implant that survives a factory reset.
They could also wipe the flash memory or push bad firmware to brick the device. That would force stores to replace hardware, and freezers could sit idle for days. Midnight Blue compares this to the wiper-style tactics seen in the December 2025 attack on the Polish electric grid.
The researchers say patching one bug at a time is a poor use of limited staff time. Owners should find every exposed controller, including those behind integrators’ 4G modems. They should then move remote access behind a VPN, a private APN, or a strict IP allow list. CERT-FR warns that allow lists are only a short-term fix.
Exposure is still high. Censys sees hundreds of Danfoss devices online, plus over 1,000 Copeland and Dixell units. Earlier Cyber Security News coverage of Copeland XWEB Pro flaws showed the same pattern. Until these controllers leave the open internet, new bugs will keep putting food and medicine at risk.
Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs
