A nightmare scenario for supermarkets: Hidden daily passwords and command injection flaws leave thousands of Danfoss supermarket systems open to remote takeover

Thousands of Danfoss refrigeration controllers were discoverable through public internet scanning A hidden daily code could bypass normal administrator password verification An email configuration flaw could enable operating system command execution Thousands of Danfoss refrigeration management systems may face remote attacks after researchers uncovered authentication weaknesses and dangerous software flaws.

Security researchers at Claroty’s Team82 used Censys, a cybersecurity platform, to identify 2,765 publicly accessible systems.

Their investigation identified three vulnerabilities affecting the AK-SM 800A controller, which manages refrigeration equipment in supermarkets, warehouses and cold storage facilities.

Hidden passwords expose refrigeration management systems The AK-SM 800A provides centralized monitoring and configuration of refrigeration equipment, including temperature settings, operating schedules, alarms, and notification services.

Its browser accessible management interface allows technicians to maintain installations remotely, but internet exposure can also give attackers direct access to vulnerable systems.

Team82 discovered an undocumented authentication mechanism that could allow attackers to circumvent the administrator password through a daily generated access code.

Designated CVE-2025-41450, the flaw involves an alternative verification process that checks a specially constructed credential against a value generated using the device’s current date.

Researchers reconstructed the algorithm responsible for generating this code by examining the controller’s firmware and authentication routines.

Anyone able to reproduce the algorithm could potentially obtain administrative access without knowing the legitimate password configured on the affected device.

That access could expose configuration settings and management functions normally reserved for authorized personnel.

The consequences extend beyond unauthorized account access because refrigeration controllers help operators maintain conditions required for preserving perishable products.

A second vulnerability, CVE-2025-41451, allows command injection through the controller’s email configuration functionality.

Researchers found that an email authentication password entered through the management interface could be incorporated into an operating system command without adequate sanitization.

Malicious input could therefore introduce additional shell commands, potentially enabling remote code execution after authentication.