CVE-2025-41450

FROMAGEGATE: hackers defrosted fridges in hundreds of French supermarkets overnight, spoiling millions in food. I reconstructed the suspected Danfoss AK-SM exploit chain (CVE-2025-41450/-51/-52) with a PoC and Suricata/Sigma detection rules. https://x.com/i/article/2109858286938038272

Les correctifs.. DSA-2025-03-01 24 mars 2025 ! CVE-2025-41450 (auth bypass) Version 4.2 DSA-2025-08-01 1er août 2025 ! CVE-2025-41451 (RCE) + 41452 Version 4.3.1

pour Grok possible : Ces boîtiers sont connectés pour permettre la supervision et le réglage à distance par les frigoristes. Les versions obsolètes (qui ne reçoivent plus de mises à jour de sécurité) étaient vulnérables. Des failles connues (notamment CVE-2025-41450, bypass d’authentification, et d’autres) avaient été documentées dès 2025 par des chercheurs (Claroty Team82, etc.), et beaucoup de ces équipements étaient accessibles ou mal isolés du réseau. Une fois à l’intérieur, un pirate a les mêmes pouvoirs qu’un technicien : modifier les consignes et forcer le dégivrage.⁠Frandroid L’ANSSI et le parquet de Paris (enquête confiée à l’OFAC) sont mobilisés. Danfoss a indiqué que la plupart des systèmes touchés étaient en fin de vie et recommandait depuis longtemps de les remplacer ou de les déconnecter d’Internet (ou de filtrer strictement le réseau). En résumé : oui, un frigo (ou plutôt son régulateur connecté) peut être piraté et « monter » à 50 °C — c’est précisément l’attaque qui a frappé la grande distribution française. C’est un exemple marquant de cyberattaque sur des systèmes industriels (OT) plutôt que sur des données clients.

@Thinker_View @CooperativeU La CVE était connu, ils ont pas mis à jour leurs logiciels, il faut arrêter les conneries à un moment …. https://nvd.nist.gov/vuln/detail/cve-2025-41450 Toujours la même histoire…

Our records show a known Danfoss vulnerability, earlier DDoS claims against the manufacturer and recent OT-access claims across Europe. These findings provide context, but do not establish who carried out the French supermarket refrigeration attack. FalconFeeds’ CVE store lists CVE-2025-41450, an authentication-bypass vulnerability affecting Danfoss AK-SM 8xxA firmware below version 4.2, rated CVSS 8.2 and published in May 2025. Threat-feed records also include Russian Legion’s January 2026 DDoS claim against Danfoss and NoName057(16)’s December 2024 claim against Semikron Danfoss. No connection to the refrigeration incident is established. On 12 October, NoName057(16) claimed #OpFrance DDoS attacks against Safran, Cartes Bancaires and three prefectures, alongside access claims involving Spanish wastewater systems and Italian CCTV. Earlier claims involved a Polish bioreactor on 27 September and a Lithuanian grain dryer on 18 September. Z-PENTEST ALLIANCE claimed access to a Belgian water-station HMI on 9 October and a Polish wastewater HMI on 10 October. WAY-KURAP OPERATION posted a French bottling-line SCADA/HMI claim on 8 October among approximately ten exposed-HMI posts that week. Separately, breacher12 advertised live Rockwell CompactLogix access in Austria on 16 September. Infrastructure Destruction Squad advertised “TRK25 Advanced SCADA”, which Blacknet00 claimed to use against a US gas-station automatic tank gauge on 8 October. These records document claims and advertisements. FalconFeeds’ Cyber Isnaad Front profile covers six Telegram channels, Israeli victims and the food-production sector, with Manamim Food Industries among the listed victims. Its latest recorded activity was a CPA-firm leak claim on 20 September 2026. No refrigeration-plant sabotage post appears in the queried records. On infrastructure, FalconFeeds tracks 31 NoName057(16)/DDoSia C2 indicators, ten re-observed on 12 October. France-tagged records include three EtherHiding payload-delivery domains from August–September 2026, an XWorm C2, Venom RAT and Quasar RAT C2s on AS3215, and an October 2025 phishing cluster impersonating ANTAI, Ameli, Crit’Air, SFR and Orange.

1. „Code-of-the-Day"-Mechanismus (CVE-2025-41450) In der Firmware der AK-SM 800A steckte ein versteckter Authentifizierungspfad: Ein internes check_code_of_day-Verfahren generierte täglich ein neues Passwort ausschließlich aus dem aktuellen Datum des Geräts. Team82 hat den Algorithmus vollständig reverse-engineert und öffentlich dokumentiert (9. August 2026) – damit konnte jeder den gültigen Code für jeden beliebigen Tag berechnen und sich als Administrator einloggen. 2. Ältere EOL-Geräte (AK-SM 800 / AK-SC 355) Noch simpler: Der Sicherheitsforscher Kevin Beaumont (GossiTheDog) bestätigte in der Nacht des Angriffs, dass bei den direkt internetzugänglichen Altgeräten das Passwort schlicht das aktuelle Datum war – username admin, password = heutiges Datum. Tausende dieser Geräte waren so über Censys auffindbar und ohne jede Authentifizierungshürde bedienbar.

@_balci_burak @YilmazDeirmenc1 Olay iOT ve Tedarik zinciri tarafında Burak hocam. Özellikle Danimarkalı üreticinin adı öne çıkıyor. Danfoss AK-SM 800A serisi kontrol cihazları için daha önce açıklanmış bir kimlik doğrulama atlatma zafiyetini, CVE-2025-41450 'ler daha önce çıkmış. Hackerler bunları kullanıyor. https://t.co/CCgfok1nPK

🔴 Fransa'da süpermarketlerin Danfoss soğutma sistemlerini hedef alan siber saldırının ardından, AK-SM 8xxA kontrol cihazlarındaki 3 güvenlik açığı için PoC ve detection toolkit yayınlandı. • CVE-2025-41450: Authentication Bypass • CVE-2025-41451: OS Command Injection (RCE) • CVE-2025-41452: Nginx Config Injection / DoS Toolkit, Suricata ve Sigma detection kurallarını da içeriyor. PoC: https://github.com/msuiche/fromagegate

🚨 Danfoss AK-SM 8xxA serisi soğutma kontrol sistemlerine yönelik daha önceden bilinen güvenlik açıkları: 🔴 CVE-2025-41450 — CVSS 8.2 (HIGH): Kimlik doğrulama atlatma. Günlük parola mekanizmasındaki zafiyet, yönetim arayüzüne yetkisiz erişime imkan tanıyabiliyor. 🔴 CVE-2025-41451 — CVSS 8.7 (HIGH): Komut enjeksiyonu. Kimlik doğrulama sonrasında özel hazırlanmış girdilerle uzaktan kod çalıştırılması mümkün olabiliyor. 🟠 CVE-2025-41452 — CVSS 6.8 (MEDIUM): Web arayüzü yapılandırmasının manipülasyonu yoluyla hizmet engelleme (DoS) saldırısı gerçekleştirilebiliyor. Açıklar, AK-SM 8xxA serisinin ilgili eski yazılım sürümlerini etkiliyor. Danfoss, düzeltmeler için 4.2 ve 4.3.1 sürümlerini yayınladı.

@_SaxX_ A priori la faille est documentée depuis mai 2025 selon le site officiel : https://www.cve.org/CVERecord?id=CVE-2025-41450

Entry method isn't confirmed yet. Known flaw: CVE-2025-41450, a high-severity authentication bypass in Danfoss AK-SM 8xxA controllers, flagged by CISA in May 2025. 2,752 Danfoss systems are exposed online, 1,590 in France.

Attackers chained CVE-2025-41450 and CVE-2025-41451 to compromise Danfoss refrigeration controllers across 350 French supermarkets. Lateral movement through inadequately segmented OT networks enabled synchronized triggering of defrost systems, destroying food inventory. Runtime segmentation helps contain such cross-system pivoting. #OTSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/cyberattack-shuts-down-refrigerators-french-supermarkets-danfoss-controllers-2026

@bluetouff hackers are exploiting known vulnerabilities in Danfoss controllers (especially the AK-SM 8xxA series). The main CVEs are: CVE-2025-41450 CVE-2025-41451 CVE-2025-41452

French supermarket refrigeration OT attack: remote forced defrost/~50°C on Danfoss controllers (AK-SM 800/800A); ~150–200 Intermarché, ~100 Coopérative U; food loss, some fires. Overlaps Team82 CVE-2025-41450/41451/41452. No claim. BFMTV (https://www.bfmtv.com/economie/consommation/la-temperature-est-montee-jusqu-a-50-degres-une-cyberattaque-contre-les-systemes-frigorifiques-provoque-la-destruction-de-produits-frais-dans-des-centaines-d-intermarche-et-de-super-u_AN-202610120327.html) #OT #ICS