French Supermarket Refrigeration Hack: Danfoss Vulnerabilities Explained

On the night of 11 to 12 October 2026, refrigeration systems at hundreds of French supermarkets were compromised. Equipment built to keep food cold became a source of heat. By the time staff noticed, temperatures in some display cases and cold rooms had reportedly reached 50°C. Perishable food was thrown out, equipment was damaged, and at least some incidents involved fires or fire-suppression systems going off. The affected retailers included Intermarché, Netto, Coopérative U, Carrefour, Monoprix and stores in the E.Leclerc network. French authorities later warned that the compromises of remote refrigeration controllers reached beyond one retailer or one product family.

The incident shows something industrial security people have been saying for years: a system doesn’t have to count as critical infrastructure to cause serious physical damage when its digital controls are compromised. Supermarket refrigeration is an operational technology (OT) environment. Software runs equipment that must operate continuously to keep food at safe temperatures, and an attacker with enough privileges over that software can do far more than knock out a computer or a web application.

CERT-FR confirmed numerous compromises involving Danfoss AK-SM and AK-SC refrigeration controllers, as well as Copeland XWEB and Dixell XWEB systems. Its alert, first published on 12 October and updated on 16 October, warned that the attack campaigns were probably still underway. Reporting links the incident to refrigeration equipment running outdated software, but the initial access method has not been publicly established. Vulnerabilities already documented in Danfoss equipment give useful technical context, but none of them can be named as the confirmed entry point.

What happened inside the refrigeration systems?

A supermarket’s refrigeration is more than a set of independent thermostats. Display cabinets, freezers, evaporators, compressors and cold rooms work as one coordinated system. Controllers regulate temperature, watch sensors, manage schedules and start defrost cycles when ice builds up on evaporator coils. A supervisory controller gives operators and refrigeration technicians one place to monitor equipment, review alarms and change configuration.

Danfoss’s AK-SM 800A is one such system manager. It coordinates refrigeration equipment and offers a browser-based interface for authorised staff to monitor and configure an installation. Changes can be applied across the whole installation instead of cabinet by cabinet.

That design helps with maintenance and energy management, and it also concentrates risk. A compromised supervisory interface can reach functions that affect multiple refrigeration circuits. How far the damage goes depends on the installation’s architecture, controller configuration, field-device permissions and physical safeguards. Even so, the security boundary around the system manager matters, because it can sit between a remote administrator and equipment that protects large quantities of food.

Contemporary reporting says the attackers changed refrigeration settings and forced equipment into prolonged defrost operation, extending defrost periods and delaying the point at which alarms would fire or staff would step in. That would explain how a malfunction became a sustained physical incident, but the full technical sequence hasn’t been independently established.

Defrost is a normal part of refrigeration. Moist air passing over a cold evaporator leaves ice on its surface, which gradually restricts airflow and heat transfer. Periodically the system warms the evaporator, commonly with electric heaters or another defrost mechanism, to clear the ice, then returns to cooling.

What separates normal defrost from the reported attack is duration and control. A properly configured system limits defrost time, monitors conditions and returns to cooling according to its control logic. If an unauthorised user can change schedules, override settings or interfere with the logic that ends defrost, a maintenance function can drive a dangerous temperature rise. The temperature actually reached depends on heating capacity, insulation, ambient conditions, refrigeration layout and how long the intervention lasts.

This is different from changing a thermostat setpoint. Raising a cooling setpoint alone doesn’t necessarily heat a cabinet to 50°C. Sustained heating through the defrost mechanism, combined with poor termination conditions or delayed intervention, is a more plausible explanation for the reported temperatures. The public evidence doesn’t show every command issued to every affected installation.

That is what defines an OT incident: changing a digital parameter changes what physical equipment does. The same applies to industrial boilers, building-management systems, water treatment plants and manufacturing lines. A compromised controller doesn’t need to steal data or encrypt files, because its normal functions become the means of damage.

Why the Danfoss AK-SM 800A matters

The AK-SM 800A became a focus of security research in August 2026, when Claroty’s Team82 published an in-depth analysis of vulnerabilities in its embedded web-management interface. The researchers examined the firmware, traced HTTP requests through the application’s internal architecture and found weaknesses in authentication and configuration handling.

Team82 also went through internet-wide scanning data from services such as Shodan and Censys and found thousands of publicly accessible management interfaces. One scan result showed 2,765 exposed devices. That figure comes from the researchers’ own scanning methodology and says nothing about the number of vulnerable supermarkets, confirmed compromises or affected installations in France.

An internet-facing management interface lets a remote attacker talk directly to an administrative application, without first compromising an employee workstation or the corporate network. Whether that leads to a compromise depends on firmware version, authentication controls and network restrictions, but exposing the interface needlessly widens the attack surface.

The research documented flaws in the web-management application itself. The findings were an undocumented authentication mechanism, an operating-system command-injection vulnerability and a separate Nginx configuration issue. Danfoss issued firmware updates for all of them. They are serious on their own, and they show how flaws in an embedded web application can undermine the equipment behind it. They don’t prove the same vulnerabilities were used in the October compromises.

CVE-2025-41450: the hidden authentication path

CVE-2025-41450 is an improper authentication flaw in the Danfoss AK-SM 8xxA series. Danfoss’s advisory says an attacker could generate a web report exposing sensitive information, including internal IP addresses, usernames, store names and other information. The vendor gave it a CVSS v3 score of 8.2 and lists firmware patch level 4.2 as the fix.

Team82’s analysis went deeper into the mechanism. The researchers examined the request-processing logic around the xml.cgi endpoint and its getauth action, and found an undocumented authentication path involving a function named check_code_of_day.

Instead of relying only on the administrator password configured on the device, this path accepted a specially constructed request containing a code generated from the device’s date. By reconstructing the algorithm, the researchers showed that the daily code could be calculated without knowing the administrator password. Basically, the password was that day’s current date. Not to mention, the username being ‘admin’.

Being undocumented isn’t the main problem. A maintenance or support feature becomes a weakness when it bypasses the authentication policy enforced by the normal login. If anyone who understands the algorithm can calculate the code, it isn’t an independent secret, and its protection rests on obscurity. A cryptographically secure, device-specific token depends on secret material an outsider can’t reproduce. Knowing the date shouldn’t be enough to generate privileged credentials.

One distinction is worth keeping. Team82 demonstrated that the hidden mechanism could bypass normal authentication, while Danfoss’s advisory describes CVE-2025-41450 mainly as unauthorised report generation and information disclosure. What a vulnerability can do, what a researcher demonstrated and how the vendor formally describes it are related but different things, and this CVE alone shouldn’t be read as documenting every possible administrative action.

The flaw also illustrates a general problem in embedded systems: legacy support functionality can outlive its original purpose. A hidden maintenance path has to be protected at least as well as the primary interface, or it undermines the controls administrators think are protecting the device.

CVE-2025-41451: from web configuration to operating-system command execution

CVE-2025-41451 is an operating-system command-injection flaw in the AK-SM 8xxA series. Danfoss’s advisory lists firmware versions before 4.3.1 as affected, warns that exploitation could lead to remote code execution after authentication, and gives it a CVSS v3 score of 8.7.

Team82 traced it to the alarm-to-email configuration. Embedded controllers commonly send email notifications so technicians hear about equipment failures, temperature deviations and other conditions, and setting that up can mean passing values to operating-system utilities or services.

The trouble starts when an application builds a shell command from web-form data without separating the data from the command. A field meant to hold a configuration value can then carry extra shell syntax, and if the operating system executes the result, input that should have stayed data runs as instructions. Team82 reported that the email authentication password was formatted into a shell command without adequate sanitisation, which let attacker-controlled shell directives in and created a path to remote code execution.

Rejecting a few suspicious characters is no substitute for designing the application so that user-controlled data can’t change the structure of an operating-system command. Safer implementations avoid invoking a shell where possible, use APIs with explicit argument handling, validate input strictly and run the process with the least privilege it needs.

What an attacker gets from a successful injection depends on the privileges of the affected process and the controller’s architecture. They may be able to run commands, modify files or interfere with services. In an OT environment the impact also depends on which operating-system resources are reachable and how the controller talks to field equipment. An email-configuration form ends up as a way into the operating system.

The vulnerability is post-authentication, though, so it isn’t an independent unauthenticated entry point. An attacker would need authenticated access already, or another weakness that provides it. Team82’s findings show why these flaws are more dangerous together, but whether this chain was used in France is unconfirmed.

CVE-2025-41452: when web-server configuration becomes an attack surface

CVE-2025-41452 concerns how the AK-SM 8xxA series handles Nginx configuration. Danfoss lists versions before 4.3.1 as affected and describes it as an externally controlled system or configuration setting issue that could lead to denial of service, with a CVSS v3 score of 6.8.

The device uses Nginx in its web-management architecture, with requests passing through several components before reaching the application’s handlers. Team82 found functionality that let an authenticated user upload a replacement configuration file for the externally exposed Nginx instance and reload the service. Administrators have a legitimate reason to want that, since embedded web applications sometimes need to change how a server processes requests, but it becomes a risk when a management endpoint accepts insufficiently constrained configuration content.

Nginx directives control web-server behaviour, including request routing and how incoming connections are handled. An attacker who can introduce arbitrary directives may change how clients reach application endpoints or cause requests to be processed unexpectedly. Team82 also reported that certain maliciously introduced routing rules could trigger an unhandled exception in the request-processing process, crashing the web service and causing a denial of service.

This is a different bug from CVE-2025-41451, which involves data entering a shell command. CVE-2025-41452 involves control over web-server configuration and the resulting application behaviour. Both show the risk of letting administrative interfaces manipulate underlying system components without restricting the permitted operations.

A denial of service can matter operationally. If technicians lose the management interface, they may be unable to review alarms, check equipment status or change configuration remotely. Whether local refrigeration control keeps working independently depends on the installation’s architecture, and losing the supervisory web interface doesn’t automatically stop every refrigeration circuit.

Management interfaces are privileged system components. File uploads, configuration editors and maintenance functions deserve the same scrutiny as authentication and network services, especially when they can affect software running with elevated privileges.

How the vulnerabilities fit together, and what remains unproven

Consider the potential attack path documented in Team82’s research. An exposed controller presents a web interface to the Internet. An authentication weakness may give unauthorised access to functionality that would normally need valid credentials. A command-injection flaw could then let operating-system commands run through the email-configuration feature. Another weakness could allow changes to the web-server configuration and disrupt the management interface.

This shows how several weaknesses combine to undermine an embedded controller, and why assessing vulnerabilities one at a time can underestimate them. An authentication bypass may first expose only limited information, but access gained through a related weakness can open a more serious route to full compromise.

It is an illustration of the disclosed vulnerabilities, not a reconstruction of the French attack. Public reporting connects the incident to compromised refrigeration controllers, and CERT-FR has confirmed numerous compromises across several product families. Neither fact establishes that the attackers used CVE-2025-41450, CVE-2025-41451 or CVE-2025-41452.

That matters for defenders. An organisation that assumes one known vulnerability explains the incident may patch it and overlook stolen credentials, compromised remote-maintenance accounts, other weaknesses or unauthorised configuration changes. Blaming a particular CVE without forensic evidence leads to wrong conclusions about which systems are at risk and what remediation is needed.

A defensible investigation would examine controller firmware versions, authentication and configuration logs where available, changes to defrost schedules, alarm thresholds and temperature setpoints, and remote-access records. It would also establish whether the management interface was publicly reachable, whether remote service providers had access, and whether other systems on the same network showed signs of compromise. Until a confirmed entry vector is published, the technical explanation has to stay within what authorities and researchers have actually established.

Internet exposure turned a local control system into a remote target

The most significant finding in Team82’s research was the scale of exposure. Its scanning identified thousands of AK-SM 800A management interfaces reachable from the public Internet, which lets attackers find potential targets without first getting into a retailer’s corporate network.

Internet-wide scanning services identify reachable systems by examining network responses, service characteristics and application fingerprints. If a management interface exposes a distinctive title or other identifying information, an attacker can work out the likely product family and look up which vulnerabilities affect its firmware. Public reachability doesn’t prove a device is exploitable, since authentication, firmware versions and network restrictions still matter. But an interface open to arbitrary Internet hosts can be tested directly, with no initial compromise elsewhere.

OT equipment is especially prone to this because its operational role is poorly reflected in conventional IT asset inventories. A supermarket may keep detailed records of employee computers, servers, point-of-sale systems and cloud services while treating refrigeration management as a job for a facilities team or an outside refrigeration contractor.

That creates an ownership gap. The contractor needs remote access, the store needs uninterrupted refrigeration, and the IT team may see little of the controller’s firmware, exposure or security configuration. Each has a legitimate requirement, but with no one responsible for security, the management interface can stay exposed long after safer options exist.

Remote administration doesn’t require unrestricted public access. A properly configured VPN, a controlled remote-access gateway or another protected management path gives technicians the access they need while limiting exposure. Access should be restricted to authorised personnel, strongly authenticated and monitored for unexpected activity, and network segmentation should stop a compromised refrigeration controller from becoming an unrestricted route into corporate systems.

CERT-FR’s October alert says the same. It advises operators to take affected units off the Internet and restore access only through a secure VPN or protected network. It allows source-IP filtering for refrigeration contractors as an emergency measure but warns against treating it as permanent. It also cautions that a factory reset alone isn’t enough for an end-of-life device that stays vulnerable, because the system may be compromised again once it returns to service.

A patch was available, but the equipment lifecycle was a problem

Danfoss’s security advisories document fixes for the vulnerabilities Team82 found. Firmware patch level 4.2 addresses CVE-2025-41450, and release R4.3.1 addresses CVE-2025-41451 and CVE-2025-41452. Team82 recommends upgrading affected AK-SM 800A controllers to R4.3.1 or later. Operators should check their installed firmware against the vendor’s current documentation instead of assuming from a device’s age or model, and apply updates through a proper maintenance process with configuration backups, compatibility checks and operational validation where required.

Patches still often go uninstalled. Refrigeration equipment is expected to run continuously, and updates can require coordination with contractors, testing, downtime planning and checks that existing configurations still work. Older equipment can be hard to maintain, and some installations have reached the end of the manufacturer’s support lifecycle.

Danfoss has identified legacy refrigeration system managers, including the AK-SM 800 and AK-SC 355, as end-of-life. Such systems may no longer get security updates. The company’s position is that supported systems should run current firmware and legacy products should be migrated to supported alternatives.

This is a familiar industrial security problem: the devices carrying the most risk are often the hardest to replace. A controller can keep running for years after software support ends, particularly when replacing it means new hardware, engineering work, changes to field-device integration and a planned interruption to refrigeration.

An inconvenient upgrade still isn’t an acceptable security exception. Where a vulnerable device can’t be patched, the organisation has to cut its exposure through network controls and decide whether to replace it. A system that can’t receive security updates shouldn’t sit directly on the public Internet just because it still does its job.

Unsupported equipment and supported equipment running old firmware are different cases. A supported controller can be fixed through the manufacturer’s update process. An end-of-life controller may need replacement or other compensating controls because no permanent software fix exists. Treating both as an ordinary patch backlog hides the different decisions they call for.

The incident extends beyond Danfoss

The AK-SM 800A vulnerabilities make a useful technical case study, but CERT-FR’s alert covers a wider set of remote refrigeration-management systems: Danfoss AK-SM, Danfoss AK-SC, Copeland XWEB and Dixell XWEB.

Operators shouldn’t treat this as a problem with one model, or assume that replacing a single vulnerable Danfoss controller covers every relevant risk. Different products have different firmware, authentication mechanisms and management interfaces, and each needs its own assessment.

What they share is remote management. These systems exist to make refrigeration easier to monitor and maintain across distributed locations, and that connectivity gives unauthorised access a route to physical operations when access controls, software maintenance or network architecture are weak.

The evidence doesn’t show that all the listed products were compromised through the same vulnerability or in the same sequence. A shared consequence doesn’t imply a shared exploit. Investigators need to establish whether different product families were hit through common credentials, exposed services, separate software vulnerabilities or other paths.

So the immediate priority for supermarket operators goes beyond checking one CVE. Every remotely managed refrigeration system should be inventoried, with its Internet exposure assessed, its firmware and support status verified and its access path reviewed. That includes equipment run by contractors, systems installed years ago and controllers missing from the retailer’s IT asset records.

What operators should do now

CERT-FR’s guidance is a practical starting point. Remove public Internet exposure from affected refrigeration controllers and restore remote access only through a secure VPN or protected management network. Emergency source-IP filtering can reduce immediate exposure but doesn’t replace a properly designed remote-access architecture.

For Danfoss AK-SM 800A installations, verify the firmware version and apply the vendor’s applicable security updates. Firmware R4.3.1 or later addresses the three vulnerabilities covered here, though operators should check the manufacturer’s current release information for the right supported version for their installation. Legacy devices that can’t receive security updates need a different plan, possibly replacement rather than repeated resets or temporary network restrictions.

Change default passwords and review authentication settings. Danfoss’s security guidance and CERT-FR’s recommendations both stress appropriate security configuration, including strict security mode where applicable. Remove unused accounts, review contractor access, restrict management services to authorised networks and make sure remote access is logged.

Review the refrigeration configuration itself too. After a suspected compromise, a web interface that responds normally or a controller restart doesn’t show the system is safe. Check defrost schedules, temperature setpoints, alarm thresholds, operating modes and other relevant parameters against approved values, look for unexplained changes, and preserve available logs before any remediation that might erase evidence.

Verify the physical process as well. Compare temperature readings against independent measurements where possible, and inspect the refrigeration system to confirm equipment is back in its intended operating state. Whether affected food can be kept needs an operational and regulatory assessment, separate from the cybersecurity recovery.

Finally, settle who owns the equipment. The retailer, IT team, facilities personnel and refrigeration contractor need to agree who handles asset inventories, firmware updates, remote access, incident reporting and replacement of unsupported systems. Without that agreement, security work falls between teams while the equipment stays connected.

What this means for OT security

The French incident is a reminder that cyber risk goes beyond data theft, ransomware and disrupted IT services. A remotely managed controller can influence physical processes, and failed access control can show up as damaged equipment, discarded food and disrupted operations instead of stolen records.

The Danfoss vulnerabilities Team82 documented show how weaknesses in authentication, shell-command construction and web-server configuration can compromise an embedded management platform, and the exposure its scans found shows why they matter beyond a single device. When administrative interfaces are publicly reachable, attackers can find them at scale and try to exploit vulnerable implementations.

The entry method hasn’t been publicly confirmed, though, and the authorities’ warning covers several refrigeration-control product families, so one date-derived password shouldn’t be blamed for the French incident. What can be said is that exposed remote-management systems created a serious risk, and the vulnerabilities documented in one major product family show the kinds of weaknesses that make that exposure dangerous.

The remedies are to remove unnecessary public exposure, keep supported controllers updated, replace equipment that can no longer be secured, restrict remote administration and verify operational settings after a compromise. They apply to any environment where network-connected software controls physical equipment.

The fridges didn’t need to be on the public Internet for technicians to maintain them remotely. They needed a controlled management path, supported software and clear ownership. Every organisation running similar equipment should ask whether its refrigeration controller is secured as seriously as any other system that can affect the real world.