Supermarket fridge controllers carry remote-takeover bugs, CISA warns
Advisories flag flaws in Danfoss and Copeland refrigeration systems that let a remote attacker skip the login screen and run their own code.
Key points
- CISA says the Danfoss AK-SM 8xxA, a controller used to run refrigeration in supermarkets and cold stores, generates admin passwords from the date and time, letting an attacker on the network calculate the password and log in.
- Two further flaws in the Danfoss unit, tracked in a separate advisory, require version 4.3.1 to fix.
- A separate CISA advisory on Copeland XWEB and XWEB Pro refrigeration controllers lists 23 vulnerabilities in firmware 1.12.1 and earlier, some allowing remote code execution.
- The worst Danfoss bug scores 8.7 out of 10 on the CVSS v4 severity scale and needs no prior login to exploit.
- Both vendors have shipped fixed firmware; what's at risk is the small industrial computer keeping food cold, not the fridge cabinet itself.
Two new advisories from the United States Cybersecurity and Infrastructure Security Agency, the federal body that warns operators about flaws in industrial kit, point at the same unglamorous target: the little computers that run supermarket refrigeration.
One covers the Danfoss AK-SM 8xxA, a controller used across food retail and cold storage. The other covers Copeland's XWEB and XWEB Pro line. Both can be reached over a network, and both will let a remote attacker get in and run commands if they haven't been patched.
What is actually broken?
The standout Danfoss flaw is almost quaint. Its controller generates a password from the current date and time, so anyone who knows the trick can calculate it. CISA tracks this as CVE-2025-41450 and rates it 8.7 on the 10-point CVSS v4 scale.
In web-security terms, it's the industrial-controls cousin of a hardcoded default password. The lock changes, but the key is printed on the door.
Danfoss fixed it in version R4.2. Two further bugs in the same product, a command injection flaw (where attacker input is treated as a system command) and an external configuration flaw, are patched in 4.3.1.
The Copeland advisory is bulkier: CISA lists 23 CVEs affecting XWEB PRO variants at firmware 1.12.1 and earlier. Successful exploitation, the agency writes, could let an attacker bypass authentication, execute arbitrary code or crash the device.
When we covered a wave of defrost attacks on French supermarkets on 14 October, a Danfoss authentication bug patched in May was the prime suspect. These new advisories confirm the class of risk isn't hypothetical.
Should shoppers worry?
Not directly, and not today. These advisories describe flaws, not break-ins, and there's no public report of anyone using these bugs against a real store.
What the advisories do tell you is where the soft spots are. A refrigeration controller sitting on the internet with old firmware is the kind of thing opportunistic scanners find in an afternoon. If an attacker got in, the realistic harm is spoiled stock and a very expensive callout, not a direct risk to a customer buying milk.
The people who need to act are engineers and facilities teams who installed these units years ago, and integrators who manage them remotely. Our earlier story on CISA and FBI guidance about third-party ICS integrators is relevant reading here.
The affected versions at a glance
| Vendor | Product | Vulnerable up to | Fixed in |
|---|---|---|---|
| Danfoss | AK-SM 8xxA | Before R4.2 | R4.2 (CVE-2025-41450) |
| Danfoss | AK-SM 8xxA | Before 4.3.1 | 4.3.1 (two further CVEs) |
| Copeland | XWEB / XWEB Pro PRO | 1.12.1 and earlier | Vendor firmware update |
The date-based Danfoss password is the detail worth filing away. It's 2026, and a networked industrial controller shipped with a password you can derive from a wall clock. Patch exists. Install base is the problem, as it always is with this hardware class, and nobody's pulling a cold aisle offline on a Tuesday to flash firmware unless someone makes them.
