Danfoss has patched three vulnerabilities in the AK-SM 800A, a controller that runs refrigeration in supermarkets, warehouses and cold storage. One of them is a hidden login that skips the administrator password.
Researchers at Claroty's Team82 used Censys, a platform that scans the internet for exposed devices, and found 2,765 publicly reachable units. The controller handles temperature settings, operating schedules, alarms and notifications, and technicians manage it through a browser interface.
CVE-2025-41450 is the undocumented login path. The device accepts a specially constructed credential that it checks against a value generated from the current date. The researchers rebuilt the algorithm from the controller's firmware and authentication routines. Anyone who can reproduce it could get administrative access without knowing the real password.
CVE-2025-41451 is a command injection bug, meaning typed input gets treated as an instruction. An email authentication password entered in the interface can land inside an operating system command without being sanitized, so extra shell commands could slip in. It requires a login, but the daily code supplies one.
CVE-2025-41452 involves the Nginx web server configuration. An authenticated function can replace the headers.conf file and reload the server, which lets an attacker add routing rules. Requests to a malicious route can crash a process called sm_app, and repeating that could lock operators out of the web interface. The researchers did not establish that every attack would stop the refrigeration itself.
Taken alone, the second and third bugs need credentials. The date-based code is what links them into a chain, from no password to commands running on the device. A password derived from the date is only as secret as the algorithm behind it, and here the researchers recovered that algorithm from the firmware.
Team82 reported the flaws privately, and Danfoss released firmware R4.3.1. Operators should upgrade to that version or later and limit administrative interfaces to trusted networks or protected VPN connections. The patch closes the holes, but it does not take the 2,765 exposed devices off the public internet. Only the operators who run them can do that.