Multiple remote code execution vulnerabilities in danfoss sm-800A

Home Services Markets Knowledge Research Cases Blog Company Contact Services Systems & vulnerability research Capability development Defensive design Knowledge Research Cases Blog sales[  ]midnightblue[  ]nl PGP (0x9035856DF1D41F73) Work with us November, 2026 30 Minutes Blog Overview Multiple remote code execution vulnerabilities in danfoss sm-800A Introduction Since October 11th waves of cyber attacks have hit internet-exposed fridge controllers by Danfoss and Copeland throughout Europe , with attackers triggering defrosting operations and causing tens of millions of euros in spoilt food damages and even causing fires in some cases. While, as pointed out by SentinelOne , attribution remains open and analysts should be careful not to immediately assume all incidents are linked to the same threat actor, the impact of these incidents (in particular their psychological effect) is in sharp contrast to their technical simplicity. While much online commentary has correctly pointed out that these kind of controllers should not be internet-exposed, remote connectivity of some sort is often a must-have due to maintenance personnel constraints and SLA or insurance requirements. As a result, many asset owners are simply content to change default credentials, apply patches for known vulnerabilities, enable strict level session control, and move on. This is insufficient and asset owners need to remove internet exposure as soon as possible (e.g. though use of a VPN, private APN, or highly restrictive IP whitelisting ACLs). We recommend against allocating scarce security resources to patching efforts and instead focus on reducing exposure. As we will demonstrate in this blogpost, Midnight Blue researcher Carlo Meijer found several pre-authentication remote code execution 0-day vulnerabilities in the Danfoss AK-SM 800A in less than an hour with casual manual inspection. Background Prior to the attack waves which started in France on October 11th, several vulnerabilities had already been documented in multiple Danfoss product lines (AK SM-800, AK SM-800A, AK-EM100) by SynAcktiv (in 2023 [ 1 , 2 ]), Claroty (in 2025 [ 3 ]), and DIVD/HackDefense (in 2023 [ 4 ]). These vulnerabilities have included the much-discussed code-of-the-day authentication bypass (CVE-2025-41450), OS command injection (CVE-2023-25915, CVE-2025-41451) and path traversal (CVE-2023-25914) vulnerabilities in the AK-SM800A, as well as SQL injection ( CVE-2023-22583 ) and OS command injection ( CVE-2023-25911 ) vulnerabilities in the EOL AK-EM100. All of these vulnerabilities are shockingly trivial to find and exploit, and the first public Proof-of-Concept (PoC) exploits were dropped within 48 hours of the French attacks [ 5 , 6 ] - preceding the second attack wave on November 2nd. According to Censys, there are still hundreds of Danfoss systems exposed online (though no doubt a sizeable chunk are by now honeypots) and over a 1000 Copeland and Dixell fridge controllers. In addition, controllers from similar vendors (such as Eliwell) which have not been targeted remain exposed in the hundreds as well. ‍ All this is to say that despite the demonstrable subpar security posture of these controllers and several attack waves with serious impact, controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance and restricting access through VPNs isn't a trivial systems change), we consider it of paramount importance for defenders not to fall into the trap of considering risks sufficiently mitigated by applying patches as is suggested by Danfoss guidance . In order to demonstrate this, we investigated the latest Danfoss AK-SM800A firmware version (5.3.2 at the time of writing) and within an hour of manual investigation (no AI necessary...) uncovered 6 pre-authentication remote code execution 0-day vulnerabilities . ‍ We are currently in a coordinated vulnerability disclosure process with Danfoss and as such will withhold technical details until disclosure is sorted, but due to ongoing targeting of these controllers we consider it important asset owners have a realistic view of the overall security posture of these devices ontrollers in order to take the appropriate measures rather than rely on piecemeal patching. ‍ Overview CVEs : Pending ‍ Vendor : Danfoss Affected products: AK-SM800A Affected versions: All up to and including 5.3.2 Vulnerability type: Multiple (6) stack-based buffer overflows ‍ Potential impact: Full device take-over, Persistent access (possibly after reset), Persistent Denial of Service (rendering device inoperable) Mitigation: Restrict network exposure through VPNs, private APN, or highly restrictive IP whitelisting ACLs ‍ 60 minutes and a firmware image Initial Investigation & Setup Danfoss AK-SM800A firmware images can be downloaded from their website and contain 7-zip compressed ARM binaries handling application logic. Danfoss AK-SM800A controllers run Danux , a custom Yocto-based Linux distribution, on an i.MX6 processor. Let's start by setting up an emulation environment for the firmware. The path of least resistance here is emulating the binary in userland, rather than emulating the entire system including the kernel. After mounting the filesystem, we can copy qemu-armel-static in there and run the following command to be presented with a shell: $ sudo chroot . /qemu-armel-static /bin/sh sh-4.4 # ‍ As pointed out by Claroty , the SM800A platform consists of an NGINX reverse proxy, a bunch of CGI handlers, and independent processes handling application logic. Requests for URLs ending with .cgi suffix are forwarded to a task created by the sm_app executable. It turns out that sm_app is a huge monolithic application that is responsible for pretty much everything that happens on the device. It is more like a mini Real-Time Operating System (RTOS) running in a userland process (a common embedded architectural choice resulting from lift-and-shift platform migrations). It has a task (thread) list consisting of 52 entries, among which are Task_Modbus_drv_task , Task_Ethernet , Task_IOHandler and Task_Web to name a few. Running the sm_app in this environment that's missing a significant chunk of the devices and drivers will almost certainly end in a crash. Applying some ad-hoc patches to the binary to avoid crashes will probably work, but potentially painful. Fortunately, we're only interested in Task_Web, so instead of fixing up everything, I can just LD_PRELOAD my way in the binary, let it run all the initialization code until it hits main(), hijack the code flow from there, apply some hooks which I won't delve into here, and start the web server. It turns out that Danux conveniently ships with gcc: $ gcc -shared -g -fPIC -o libpreload.so preload.c $ sudo chroot . /qemu-armel-static -E LD_PRELOAD=/libpreload3.so /danfoss/sm_app hi from hijacked code ‍ With some additional minor fixes, we are now able to talk to the emulated web server: $ curl -v -d '' http://127.0.0.1:8080/xml.cgi * Trying 127.0.0.1:8080... * Connected to 127.0.0.1 (127.0.0.1) port 8080 > POST /xml.cgi HTTP/1.1 > Host: 127.0.0.1:8080 > User-Agent: curl/8.5.0 > Accept: */* > Content-Length: 0 > Content-Type: application/x-www-form-urlencoded > < HTTP/1.1 200 < Date: Sat, 07 Nov 2026 21:44:33 GMT < Content-Type: text/xml < Content-Length: 75 < Connection: keep-alive < Server: Danfoss SM800A < Access-Control-Allow-Private-Network: true < Access-Control-Allow-Origin: * < Access-Control-Allow-Methods: GET, POST, OPTIONS < Access-Control-Allow-Headers: aksm-auth,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type < Cache-Control: no-store, no-cache < * Connection #0 to host 127.0.0.1 left intact