← Tuesday, October 13, 2026SecurityVulnerability

Danfoss refrigeration controllers had authentication bypass and command injection flaws

claroty.com 10 min read Editor score 7/10

Research on the Danfoss AK-SM 800A found a hidden code-of-the-day mechanism that could bypass authentication and a command-injection flaw leading to remote code execution; Danfoss addressed the issues in firmware. The case illustrates risks in internet-connected operational technology, though it concerns a specific product.

What: Danfoss AK-SM 800A refrigeration controllers have vulnerabilities in their embedded web management interface.
How: Researchers found an authentication bypass, command injection leading to remote code execution, and a way for authenticated users to inject Nginx directives.
Why it matters: Compromising a centralized controller can affect refrigeration operations across supermarkets, warehouses, and other sites.

Requests flow through the controller’s web server to handlers and the underlying implementation. Sketched from the article's own text.

Read on claroty.com → Lobsters

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.