Your refrigeration controller is a web server on the public internet

On the night of Sunday 11 October 2026, refrigerators in French supermarkets started warming up. Someone reached the controllers that run the cold aisles and triggered the units’ own defrost cycle. French reporting put the count at 250 to 350 stores across Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc and Super U, with Intermarché’s owner saying display cases were heated to 50°C for six hours overnight. The Paris prosecutor’s office opened an investigation covering both the food losses and the outbreak of fires.

The equipment in the middle of this is a box with a web management interface, installed by a refrigeration contractor and reachable from the internet. CERT-FR’s alert names the Danfoss AK-SM and AK-SC series, and its current version also covers Copeland xweb and Dixell xweb. Those are not one population. Some models were withdrawn from sale years ago and will never get another firmware release. Others are current products that have fixes available and are running old firmware anyway. The two need different answers, and we come back to that. You probably own devices with the same shape: building management, HVAC, UPS panels, badge readers, lifts, solar inverters. A trade installed them, not IT. Worth checking whether any of them are in your asset register.

A second supermarket disruption ran in parallel and is not the same story. Albert Heijn and its parent Ahold Delhaize shut systems down on the same Sunday and left fresh produce shelves empty across the Netherlands, at a cost local reporting puts around 10 million euros. Ahold has said there’s no evidence of a link between the two. The Dutch incident is still a logistics outage with no public technical detail. The French one has more on the record, and what’s on the record is exposure: these management interfaces answer on public IP addresses by the thousand, and CERT-FR’s alert names no entry vulnerability at all. Separately, researchers have shown that one of the named controller families hands out an administrative session to anyone who can reproduce a routine shipped in its own firmware. Nobody has tied that research to the attack, and the two are worth keeping apart. The design question the research raises is the older one: what happens when the secret is a routine anyone can read.

A password computed from public inputs is not a password

Start with that design question. It reads like a joke until you check the firmware.

Does rotating a password every day make it stronger?

Not when everything that feeds the calculation is public.

Mattias has solar panels whose admin password is the manufacturer’s name plus the current date, so changing a setting means typing a different string today than yesterday. Andrey’s first reaction was that this beats a static password, because yesterday’s value is already dead. Mattias’s answer is that it beats nothing once the algorithm is in reach, and the only inputs here are the vendor’s own name and the day on the calendar.

Hiding the algorithm instead of the password is the same bet one level down. Which end holds the copy, the client or the controller, isn’t something you can tell from outside, and it doesn’t change the outcome. Whoever has the algorithm has the password.

That’s close to what Claroty’s Team82 found in the Danfoss AK-SM 800A. They reverse engineered the firmware, found a hidden authentication path in the getauth handling for xml.cgi, and recovered a routine called check_code_of_day that derives a password from the device’s current date instead of checking the administrator password. Reproduce the function, and you have an administrative session without knowing the admin credential. It’s tracked as CVE-2025-41450, and CISA published it at CVSS 8.2 in May 2025 for versions prior to R4.2. That is a demonstrated flaw in a product family, not a finding about France. Nobody has placed check_code_of_day at the scene.

The objection to answer is that plenty of good schemes compute a credential. TOTP does exactly that, deriving a fresh code from the clock through an algorithm anyone can read, and it holds up because the key behind it is per device and stays protected. What fails is a derivation whose every input is public: a vendor name, today’s date, a routine shipped in the firmware. The distinction worth keeping is between a secret you can change and a mechanism you cannot change by changing secrets. Rotating the administrator password does nothing to a path that never checks it, and check_code_of_day never checks it. Firmware logic can be replaced, and Danfoss replaced it: R4.2 for the authentication bypass, R4.3.1 for the command injection and the configuration flaw alongside it. The catch is that the fix has to reach a box nobody thinks of as software, through a contractor whose job is cold shelves.

The basics were skipped long before the algorithm mattered

The authentication bypass is the interesting flaw. It also isn’t the first thing you’d fix, because this equipment is reachable by strangers before any of it matters.

How exposed is this class of device?

Thousands of management interfaces answer on the public internet today.

On the Monday after the attack, Predicta Lab counted 2,752 Danfoss systems exposed online, 1,590 of them in France, while Shodan was tracking over 4,500 reachable Danfoss devices. Team82’s own research, published 9 August 2026, carries a Censys screenshot showing 2,765 exposed AK-SM 800A devices and doesn’t date the scan. None of those counts tell you how many run vulnerable firmware. They tell you that finding this class of device takes a search box.

The firmware side is no better. CISA’s advisory, updated in August 2025, lists three flaws in the AK-SM 8xxA series: the authentication bypass fixed in R4.2, CVE-2025-41451, a command injection through the alarm-to-mail configuration, and CVE-2025-41452, external control of the Nginx configuration, both fixed in R4.3.1. Older models get nothing at all. Danfoss’s October 2025 Tech Insider bulletin records the AK-SM 800 as declared end of life in May 2021 and the AK-SC 355 as phased out in 2016. It then announces a hard end of service for legacy products that have already reached end of life. The reason it gives is that continuing to service them would place Danfoss under new legal obligations to maintain security updates. Danfoss told The Register that the French systems were running outdated firmware.

CERT-FR published its alert on 12 October with instructions for operators. Take the units off public IP addresses, and restore access only through a VPN or a protected network. Review the full configuration, defrost schedules included. Then apply the manufacturer’s hardening steps, which for Danfoss means a firmware update, the Strict security level and default passwords actually changed. Filtering a firewall down to the refrigeration contractor’s own source addresses is in there as an emergency option, and the alert says not to treat it as a lasting fix. For a compromised unit it adds a restart or factory reset, which clears the intruder’s persistence and leaves the box as vulnerable as it was. The alert did not tie the attack to a specific vulnerability.

Keep those two apart, including when you write this up internally. Research shows what a controller allows once somebody reaches it. It does not show what happened in France, and nobody has claimed the attack.

Nobody in the chain was hired as the security person

That leaves the question of how a device ends up in this state for a decade.

Whose job is it to secure a supermarket’s fridge controllers?

Nobody can tell you from outside, which is why it’s worth reading your own contracts.

The contractor who installs refrigeration sells and connects refrigeration. Connecting the controller to the internet is how remote support works, and it’s the path the product makes easy. The store buys cold shelves and expects cold shelves. Neither party is an IT organisation. What none of us can see from here is what their agreements actually say about firmware, so treat the ownership gap as a hypothesis about France and a question about your own estate.

That question transfers cleanly. Check whether devices installed by contractors have an owner responsible for firmware updates: the HVAC controller, the UPS web card, the generator panel, the camera recorder, the inverter on the roof. The answer belongs in the maintenance agreement, next to two others. Who holds remote access and by what route. What happens when the model goes end of life.

So the practical move isn’t a policy. It’s a walk around the building with someone from facilities, asking which boxes have a network cable and who reaches them remotely, then checking the answers against the paperwork.

Reverse engineering got cheaper to automate

Hiding logic in a binary was always a weak defence. What changed is who can run the tooling that defeats it.

What changes when a model can drive the decompiler?

The mechanical part of firmware analysis gets automated.

It was always possible. Team82 did it with human skill, time and know-how, and that combination used to be the real protection. Now the decompiler talks to the model directly. GhidraMCP exposes Ghidra through an MCP server. A model connected to it can decompile and analyse a binary, rename methods and data, and list methods, classes, imports and exports. It also runs headless, with no GUI in the way. Its README describes the aim as letting models “autonomously reverse engineer applications”. How much of the work still needs somebody who knows what they’re reading, it doesn’t say, and we haven’t seen that measured.

The refusals in frontier models are a real speed bump and a poor control. We ran a pen test with Claude recently and it took a lot of convincing, including proving we owned the domain, before it would start. Open-weight models are more permissive, and less restrained models exist for people on an approved list. So treat the capability as reachable by whoever wants it badly enough, and design as if the attacker has a decompiler that never gets tired.

A detector made of patterns is a puzzle with a published answer

The same logic reaches the tools you’re defending with, not just the products you ship.

Can someone use a model to find a way past a pattern-based filter?

Probably, where the control is a list of patterns and the list is public. That’s our prediction, not a finding.

Some of what sits in the detection path is pattern matching. Network intrusion detection reads traffic and looks for a known shape in a known order. Where input validation is a deny-list of regexes in an open source library, the patterns are readable by anyone. Getting past that kind of control has been pen test work for years, done by hand, one encoding at a time. The version we expect next is to hand the library to a model and ask it where the pattern fails.

We haven’t seen a documented case of this at scale, and nothing in the research above demonstrates it. The ingredients are public, which is the part worth planning around. If a control depends on the attacker not having read your rules, it has the same weakness as the fridge.

The answer isn’t to throw away the regex, it’s to stop treating it as the boundary. OWASP’s Input Validation Cheat Sheet tells you to define what the application accepts and reject everything outside those rules, rather than try to recognise every malicious string. It also tells you to decode a field according to the protocol, and normalize it by one policy, before the field rules run. Then keep signals that don’t depend on the payload’s shape at all: who connected, from where, at what hour, and what the device did afterwards.

Solar inverters are the same bet with the grid attached

Spoiled stock is an expensive week. The same pattern in power generation is a different order of problem.

Is any of this bigger than a supermarket?

The exposure numbers in renewables say yes, without needing a conspiracy.

Modat published To See the Wind and the Sun on 6 October 2026. The research confirmed 8,547 exposed systems belonging to solar parks and wind farms across 35 countries in the EU, EFTA and EU candidate states. Some front a single turbine. Others control a whole farm from one screen. Modat says the real number is higher, because it counted only what it could tie to a site.

Then there’s the supply side. The IEA’s July 2026 commentary on inverter supply chains and cybersecurity puts China at roughly 80% of global inverter manufacturing capacity against Europe’s 8%, and notes that modern inverters are internet-connected and remotely controllable by design. Reuters reported on 14 May 2025 that US experts stripping down grid equipment found undocumented communication devices, including cellular radios, in some Chinese inverters and batteries. Anonymous sources, no unit count: an unconfirmed claim for months. Not any more. The US Federal Railroad Administration’s safety alert of 29 January 2026 says a US Department of Energy report corroborates the open source reporting of unexplained communication devices inside Chinese-made inverters and batteries. It then tells railroads to go find those inverters in their own environment.

Scale and intent stay open. A Department of Energy analysis of roughly 30 inverters, reported the day before that alert, found two whose communications differed from their documentation and judged both non-malicious and unintentional, with no definitive evidence of a malicious wireless function. Which manufacturers, how many units, whether any was ever used against a site: none of that is settled.

Spain’s April 2025 blackout wasn’t this, though the intuition is common. The Spanish government committee’s non-confidential report of 17 June 2025 found no evidence of a cybersecurity event directly related to the crisis, and no lateral movement between IT and OT networks. The ENTSO-E expert panel’s final report of 20 March 2026 attributes it to a loss of voltage control and the disconnections that followed.

The defensive work is unglamorous. Write down every remote connection a vendor holds into your assets, with who uses it and whether it can change operation or only read it. Give each vendor an individual account, and split command rights from monitoring rights. Keep the logs yourself. A modem inside the box appears in none of that, so add a physical inspection.

The rules arrive in December 2027

New EU rules do push default credentials out of products. The timing is the part to plan around, and it lands later than it sounds.

When do the new EU rules actually touch this equipment?

For products placed on the market from 11 December 2027, and for one already installed, only in two narrow ways.

The Cyber Resilience Act, Regulation (EU) 2024/2847, requires in Annex I that products with digital elements be made available “with a secure by default configuration” and that they “ensure protection from unauthorised access by appropriate control mechanisms”. Article 71 sets the dates: the regulation applies from 11 December 2027, with the Article 14 reporting duty starting 11 September 2026.

Article 69 covers what is already out there, and it cuts both ways. Products placed on the market before 11 December 2027 come into scope only if they are substantially modified from that date. The exception is Article 14: the manufacturer’s duty to report actively exploited vulnerabilities and severe incidents applies to those older products too, from 11 September 2026. Both are duties on the manufacturer. Neither obliges you, the operator, to replace an end-of-life controller, and neither produces a firmware release for one.

There’s an earlier deadline for radio equipment, narrower than “anything with a radio in it”. The cybersecurity requirements of the Radio Equipment Directive have applied since 1 August 2025, postponed from 2024, through Delegated Regulation 2022/30 as consolidated. Its Article 1 applies the network-harm requirement in Article 3(3)(d) to radio equipment that can itself communicate over the internet. The privacy requirement in 3(3)(e) covers four categories, internet-connected radio equipment, childcare equipment, toys and wearables, and bites only where the equipment processes personal data, traffic data or location data. The fraud requirement in 3(3)(f) reaches internet-connected equipment that lets the user transfer money or virtual currency. Medical devices are carved out of all three; aviation, type-approved vehicle equipment and road tolling, out of the last two. When the Commission cited the EN 18031 harmonised standards it restricted clauses 6.2.5.1 and 6.2.5.2, precisely because they let a manufacturer allow a user not to set a password at all. A wired refrigeration controller isn’t radio equipment, so none of that reaches it.

None of this patches an AK-SC 355 phased out in 2016. What it does is put the work on a budget line, and a dated duty on the manufacturer with a product standard behind it is easier to fund an inventory against than a risk register entry. It arrives slowly, and it’s worth asking for anyway.

What this means for teams

Keep two things apart when you take this back to your own estate. What researchers demonstrated on a Danfoss controller is documented: an alternate authentication path that ignores the admin password, a command injection, published CVEs, fixed firmware versions. What happened in France is not: no published initial access, no claim, no ransom demand on the record. The part that transfers is the exposure, not the story.

That exposure is visible from your side before anyone uses it. Management interfaces reachable from the internet, published vulnerabilities against models you run, firmware past support, and credentials anyone can derive from inputs they already have.

Four things worth doing this week:

• Inventory the devices IT didn’t install. Walk the building with facilities and ask which boxes have a network cable, who reaches them remotely, and through what. The CMDB may well not have them.
• Take management interfaces off the public internet. Drop the port forward and put remote access behind a VPN. Open source VPNs are cheap, and CISA’s advice on this equipment is explicit: minimise exposure, firewall control networks away from business networks, and remember a VPN is only as secure as the devices on it.
• Check support status by model number, not by vendor name. If the model is end of life, the plan is isolation and a replacement date, because no patch is coming.
• Design as if the algorithm is public. Reject any credential a stranger can compute from public inputs alone, a vendor name and a date being the example here. A keyed scheme is fine when the key is a per-device secret the firmware protects and you can rotate it without a site visit.

And one judgement call worth making deliberately: some of this equipment doesn’t need to be smart. If remote access buys you a convenience rather than an operational requirement, a dumb thermostat is a defensible architecture.

Common questions, answered

How do I get a refrigeration or building controller off the public internet?

Drop the port forward or NAT rule that exposes its web interface, and give remote support a VPN instead. Then find the others: scan your own public ranges, and ask every contractor with a maintenance agreement which devices they reach and how. CISA’s advice for this equipment is to keep control networks behind firewalls, isolated from business networks, and to use a VPN where remote access is needed. Filtering to the contractor’s source addresses is an emergency measure, and CERT-FR says it shouldn’t be treated as lasting.

What should I do with a controller whose vendor ended support?

Isolate it, because no patch is coming. Danfoss puts the AK-SM 800 at end of life since May 2021 and the AK-SC 355 phased out in 2016, and will cease all services for legacy products. Put it on a segmented network with no inbound route from the internet, change every credential you can change, log what talks to it, and attach the model number to a replacement line in next year’s budget. CERT-FR warns that a factory reset clears an intruder’s persistence but leaves the device as vulnerable as it was.

How do I check whether a vendor can remotely control my equipment?

Ask for a written list of every remote connection into your assets, naming who connects, to which device, and whether that access can change operation or only read it. Check it against your own network logs. A link that leaves by another route, a cellular modem inside the device, won’t show up there, so pair the log check with a physical inspection and a direct question about out-of-band connectivity. Require individual vendor accounts instead of shared credentials, separate command rights from monitoring rights, and keep logs you control.

Related episodes

• Episode 108, Assume You’re Vulnerable: Security Beyond Patching is the argument for what you do when a patch isn’t available, which is the whole end-of-life controller problem.
• Episode 102, The 90-Day Patch Window Is Dead covers how fast exploitation now follows disclosure, with Ian Amit and Matias Madou.
• Episode 81, Keeping Secrets Safe is the checklist for which kinds of secrets are at risk and which tool fits which consumer, whether that’s a human, a CI/CD pipeline or a workload.
• Episode 87, EU Compliance 101: AI Act, DORA, NIS2 explained is the regulation background behind the budget line this episode ends on.
• Episode 111, AI Agents: When Helpful Becomes Harmful is the other half of the AI question here, what capable models do when nobody has scoped them.

Resources

• Claroty Team82, Freeze the Controller, Defrost the Food is the primary research on the Danfoss AK-SM 800A, including check_code_of_day and the Censys count of exposed devices. It does not address the French incident.
• CISA advisory ICSA-25-140-03 settles the affected versions, the CVSS scores for CVE-2025-41450 through CVE-2025-41452, and the official mitigation list.
• CERT-FR alert CERTFR-2026-ALE-012 is the operator guidance for the French incident, including the emergency IP filtering caveat and the factory reset warning, and the current list of affected products, Danfoss, Copeland xweb and Dixell xweb. It names no entry vulnerability.
• Danfoss Tech Insider, October 2025 is the vendor’s own end-of-service notice, pages 7 and 8: the AK-SM 800 at end of life since May 2021, the AK-SC 355 phased out in 2016, and no further service for either.
• OWASP Input Validation Cheat Sheet settles the allow-list question: define what you accept, decode and normalize before the rules run, and don’t try to enumerate every malicious string.
• Regulation (EU) 2024/2847, the Cyber Resilience Act is the text behind the secure-by-default requirement in Annex I, the application dates in Article 71 and the legacy-product rules in Article 69.
• Delegated Regulation (EU) 2022/30, consolidated text is the version that carries the postponed 1 August 2025 application date and the scope of the three Radio Equipment Directive cybersecurity requirements.
• Modat, To See the Wind and the Sun is the primary research behind the 8,547 internet-facing wind and solar systems across 35 countries, and the disclosure route through national CERTs.