Hundreds of Danfoss cooling systems remain accessible via the internet, even though security updates for the systems have been available for over a year. This is according to research by The Shadowserver Foundation. This information is important because cybercriminals recently managed to hack into supermarket cooling systems in several countries.
Shadowserver is a nonprofit organization that tracks down vulnerable systems on the internet. It has identified 170 Danfoss AK-SM8xxA controllers that lack updates for two security vulnerabilities. These are the vulnerabilities CVE-2025-41451 and CVE-2025-41452. In addition, the organization discovered 136 controllers that have not been updated to address a third vulnerability, CVE-2025-41450.
The controllers are used to remotely manage cooling systems in supermarkets and other commercial buildings. Administrators can adjust settings and continuously monitor the systems’ operation via a network connection. Because the systems are accessible online, vulnerabilities can also be exploited remotely.
Bypassing authentication
The three vulnerabilities have different consequences. CVE-2025-41450 allows hackers to bypass authentication. They can gain access to a controller without valid login credentials. Danfoss already released a security update for this vulnerability on March 24, 2025.
The other two vulnerabilities require an attacker to already have access to the system. One vulnerability allows hackers to execute arbitrary code, while the other can lead to a disruption in availability. Updates addressing these issues have been available since August 1, 2025.
The combination of these vulnerabilities poses a particular risk; a cybercriminal who manages to bypass authentication may also be able to exploit a second security vulnerability and gain more extensive control over the installation.
Most vulnerable systems in USA and France
These findings follow attacks on supermarket cooling systems, in which CVE-2025-41450 was exploited. According to Shadowserver, most of the vulnerable controllers are located in France and the United States.