Six new pre-auth RCE flaws found in Danfoss AK-SM800A controllers amid active attacks

Six new zero-days in a device under active attack

Security firm Midnight Blue says it discovered six previously unknown pre-authentication remote code execution vulnerabilities in Danfoss AK-SM800A controllers, all of them stack-based buffer overflows. Every firmware version up to and including 5.3.2, the newest release at the time of the analysis, is affected. The researchers are withholding technical details and CVE identifiers while a coordinated disclosure process with Danfoss is underway, but they note that the flaws surfaced after roughly an hour of manual investigation of the vendor-supplied firmware image.

The findings arrive mid-incident. According to Midnight Blue, attack waves against these controllers began in France on 11 October, and public proof-of-concept exploits for older vulnerabilities appeared within 48 hours of those first attacks, ahead of a second wave on 2 November.

A device with a long history of trivial bugs

The AK-SM800A was already known to be in poor shape. Midnight Blue points to earlier research from SynAcktiv in 2023, Claroty in 2025, and DIVD and HackDefense in 2023, which collectively documented an authentication bypass (CVE-2025-41450), OS command injection (CVE-2023-25915 and CVE-2025-41451), and path traversal (CVE-2023-25914) in the AK-SM800A, along with SQL injection (CVE-2023-22583) and OS command injection (CVE-2023-25911) in the end-of-life AK-EM100. The researchers describe all of these as remarkably easy to discover and exploit.

What the firmware looks like inside

Danfoss publishes firmware images on its website; they contain compressed ARM binaries and run Danux, a custom Yocto-based Linux distribution, on an i.MX6 processor. The web-facing surface consists of an NGINX reverse proxy that forwards requests for .cgi URLs to handlers inside sm_app, a monolithic process that behaves almost like a small real-time operating system, with 52 internal tasks covering everything from Modbus to the web server.

Rather than emulating the whole system, Midnight Blue ran sm_app in userland under QEMU and used an LD_PRELOAD shim to take over control flow at main(), starting only the web task. What they found in the code was discouraging: hundreds of calls to strcpy, a function with no length limit, sitting in externally reachable handlers that require no authentication. In earlier firmware releases, each command handler enforced authentication on its own instead of through a central check, which needlessly widened the unauthenticated attack surface. A checksec scan shows the binary has no stack canaries, no position-independent executable support, and only partial RELRO, leaving classic memory-corruption exploitation largely unimpeded.

A fleet that is still online

Censys data cited by the researchers shows hundreds of Danfoss systems still exposed to the public internet, a sizeable share of which are probably honeypots by now, alongside more than 1,000 Copeland and Dixell fridge controllers and hundreds of Eliwell controllers from comparable vendors that have not been targeted yet.

Midnight Blue warns that the impact of the new flaws includes full device takeover, persistent access that may survive a reset, and permanent denial of service that renders the hardware inoperable. Their blunt message, spelled out in the post's title, is that patching alone is not an adequate response: Danfoss guidance emphasises updates, but six unpatched zero-days mean asset owners cannot assume the risk is contained. The recommended mitigation is to remove the controllers from the open internet entirely, using VPNs, private APNs, or tightly restrictive IP allow-lists. The researchers acknowledge why that often does not happen: supermarket chains can breach SLA or insurance conditions by cutting off remote maintenance access.

Why it matters

The AK-SM800A sits at the unglamorous end of operational technology, quietly keeping supermarket refrigeration and building systems running, which makes it easy to overlook and painful to take offline. This incident illustrates the gap between vendor patch cycles and reality: years of documented vulnerabilities, active exploitation in the wild, and fresh pre-authentication RCEs that a single researcher found in about an hour. For any organisation running embedded controllers with an internet-facing web interface, the defensible position is network isolation first and patching second. Until Danfoss ships fixes and owners restrict access, hundreds of these devices remain one malicious request away from full compromise.