France’s CERT-FR said on October 12 that it knows of numerous compromises of remote controllers for refrigeration installations, and it told operators to cut Internet exposure for every affected unit.
What the CERT-FR alert says
CERT-FR, the response team inside France’s national cybersecurity agency ANSSI, published alert CERTFR-2026-ALE-012 on October 12 and updated it on October 13. The alert lists four affected product lines: the Danfoss AK-SC and AK-SM series, Copeland xweb and Dixell xweb. It names no CVE and gives no entry method. It does say that exposing a management interface to the Internet runs against good practice in general.
The guidance has two tracks. For units that show no sign of compromise, CERT-FR asks operators to remove Internet exposure from the affected units and from any other unit sitting on a public IP address, and to check the full configuration, defrost windows in particular. It also asks them to review the insurance contract before cutting the data link to the refrigeration contractor. Service comes back only through a secure VPN or a protected network. In an emergency, a firewall rule that filters source addresses down to the contractors’ ranges is acceptable, and CERT-FR says that is a stopgap.
For units that are compromised, the exposure comes off first, then the unit is factory reset and reconfigured before it returns to service. For Danfoss gear, CERT-FR’s example steps are a firmware update, the security level set to Strict, and a check that default passwords were changed.
End-of-life units change the fix
The alert carries a separate warning for equipment that no longer gets security patches. CERT-FR says that keeping an end-of-life (EOL) device on the Internet makes compromise very likely, and that a factory reset alone does not solve it. The reset removes whatever persistence an attacker left, yet the unit stays vulnerable and will probably be compromised again.
Danfoss has said where its older System Manager line stands. In its October 2025 Tech Insider newsletter, the company says the AK SM 800 was declared End of Life in May 2021, that End of Life leads to End of Service, and that it enforces a hard End of Service policy for legacy products that already reached End of Life. The newsletter ties that policy to recent European cybersecurity legislation. The current AK-SM 800A has its own download and security page, where Danfoss says software package v4.0x and above defaults to a stronger security posture through Session Control.
What Claroty counted in August
CERT-FR’s alert does not say which weakness the intrusions used, so the closest public evidence of how these controllers sit on networks is earlier research. On August 9, Claroty’s Team82 published an analysis of the AK-SM 800A. The researchers searched internet-wide scanning platforms for the controller’s management interface and report 2,765 exposed devices according to Censys.
“Numerous controllers were directly accessible from the public Internet,” wrote Amir Zaltzman, a vulnerability researcher at Claroty Team82. He also explained why the interface exists: “Because technicians frequently administer these systems remotely, the AK-SM 800A includes an embedded web server that exposes a browser-based management interface.”
Team82 reported three vulnerabilities in that product family to Danfoss: CVE-2025-41450, an authentication bypass rated CVSS 8.2; CVE-2025-41451, a command injection that could lead to post-authentication remote code execution, rated 7.6; and CVE-2025-41452, a configuration injection that could cause denial of service, rated 5.4. Danfoss lists the fixes in advisories DSA-2025-03-01 and DSA-2025-08-01, which call for version 4.2 and version 4.3.1 or later. Those advisories concern the AK-SM 8xxA series, while CERT-FR’s list also includes the AK-SC series, Copeland xweb and Dixell xweb. Team82’s own advice for the AK-SM 800A is to keep administrative services reachable only from trusted management networks or through VPNs and other segmentation controls.
What it means for the security leader
The alert puts the first fix at the network edge, which makes the owner of the site network the person who decides. At a retailer or a cold-storage operator, that is usually a facilities team or a refrigeration contractor with a remote maintenance link, and those assets may never have reached the security team’s inventory. Our earlier piece on attackers targeting the consoles that secure you describes the same pattern with security tooling; here the console runs cooling equipment, and a changed defrost schedule has a physical result.
In our reading, the contractor’s remote path is the piece least likely to appear on a network diagram. CERT-FR’s insurance caveat points the same way: an operator may have contract terms attached to a data uplink that the alert tells it to cut. That conflict is better settled before an incident than during one, and it belongs in the exposure inventory that decides the first hour after an advisory.
What to do this week
Ask facilities and the refrigeration contractor for a list of every building-systems controller and whether it answers on a public IP address. Take any listed Danfoss, Copeland xweb or Dixell xweb unit off the Internet and put contractor access behind a VPN, using a source-address allowlist only as a short-term measure. Check defrost schedules and temperature setpoints on each unit. Confirm firmware versions, set Danfoss units to the Strict security level, and confirm default passwords are gone. Put any unit that no longer receives updates on a replacement schedule, because CERT-FR is explicit that a reset will not hold. Finally, settle the insurance and uplink question with the contractor now, so a cut-off decision can be made in minutes.
