Shadowserver Warns of Danfoss Refrigeration Controller Flaws with 170 Exposed Globally

Cybersecurity monitoring organization Shadowserver warned on November 10 that vulnerable Danfoss AK-SM8xxA series refrigeration controllers remain exposed to the public internet. This follows cyberattacks across multiple European countries where attackers remotely manipulated refrigeration controllers to alter temperature settings or trigger defrost cycles. As of November 8, approximately 170 devices globally were detected exposed to CVE-2025-41451 and CVE-2025-41452, with 136 exposed to CVE-2025-41450. Geographically, Europe accounts for 117 exposed units (including 60 in France), followed by North America with 25. The vulnerabilities involve authentication bypass and OS command injection, potentially allowing attackers to gain device control or execute remote commands. Danfoss has released firmware version 4.3.1 to address the issues, while Shadowserver urges administrators to patch and disconnect controllers from the public internet immediately.

Key takeaways

• Shadowserver reported that as of November 8, approximately 170 Danfoss controllers were exposed to CVE-2025-41451 and CVE-2025-41452, alongside 136 units exposed to CVE-2025-41450.
• Geographically, exposed units are concentrated in Europe (117 units, 60 in France) and North America (25 units).
• Recent European attacks leveraged flaws allowing authentication bypass or command injection to alter temperatures and trigger defrost cycles.
• Danfoss has released firmware version 4.3.1 to patch the flaws, with experts urging administrators to remove units from the public internet.