DEV Community

andreagomez
andreagomez

Posted on

Three CVEs, One Disconnected Panel: Reading Exposure Without a Version Scan

#security #zoomeye #ot #cve

Three CVEs, One Disconnected Panel: Reading Exposure Without a Version Scan

The French supermarket incident of 11 October 2026 arrived with a vulnerability trail attached: three CVEs in Danfoss AK-SM 800A controllers, patched in 2025, chained by a researcher into remote code execution. It also arrived with a remediation pattern that ignored the trail entirely. Operators disconnected panels instead of patching them, and the data shows the disconnection, not the fix.
That gap is the useful lesson for anyone whose OT estate is visible from outside.

What the vulnerability record actually says

Danfoss patched CVE-2025-41450 in March 2025 and CVE-2025-41451 and CVE-2025-41452 in August 2025. The fixes land in StoreView 4.3.1 and later, against a current release of 5.3.2. A researcher at Claroty demonstrated that CVE-2025-41450 and CVE-2025-41451 could be chained to reach remote code execution, disable cooling and falsify temperature readings.
Danfoss stated that most affected controllers were either older models no longer receiving security updates, the AK-SM800 and AK-SC355, or newer AK-SM800A units running outdated firmware. It has not confirmed the initial access vector. That last point matters more than it usually does in incident reporting: the plausible explanation, unpatched exposed controllers, is a hypothesis consistent with the evidence rather than a confirmed step.

What Censys measured

Censys tracked internet-exposed StoreView panels through the incident. On 11 October it counted 2,991 worldwide, 1,825 in France. The French count fell to 1,781 on 12 October and 537 on 14 October, a 71% drop; outside France the count moved from 1,166 to 966.
The version breakdown is the part that changes how the incident should be read. On 11 October, 74% of French exposed instances ran below 4.3.1, against 81% in Poland, 80% in Romania and 76% in Belgium. The Netherlands still had 62 exposed unpatched instances and the United States 58.
Censys then made an inference that is worth restating as an inference: because all three version categories it tracked shrank by roughly 70%, including instances already on patched releases, patching was not the mechanism. Disconnection was. A patched panel and an unpatched panel were removed from the internet at the same rate.

What an external engine can and cannot see

A public scanning engine cannot read firmware version. It cannot tell whether a given AK-SM800A running 4.2.4 has been updated to 4.3.1, whether it has been firewalled to an allow-list, or whether it has been powered down. It can say whether the panel answered from a public address at a particular moment.
The ZoomEye header query on 22 October 2026 illustrates both the reach and the ceiling:
| Query | Result |
| --- | --- |
| http.header="Danfoss" | 260 |
| http.header="Danfoss" && country="FR" | 1 |
| http.header="Danfoss" && country="NL" | 54 |
| http.header="Danfoss" && country="US" | 28 |
| http.header="Danfoss" && country="DE" | 25 |
| title="AK-SM" | 2 |
| title=="StoreView" | 1 |
| body="StoreView" | 2 |
The country result is the important one. One French asset, four days after Censys reported 537, is not a contradiction and not a correction. The header string and the StoreView fingerprint identify different populations, and no version information is present in either. A team that read the French figure of 1 as reassurance would have drawn a conclusion the query cannot support.
The narrow queries are equally instructive. title="AK-SM" returning 2 results does not mean two AK-SM controllers exist on the internet. It means two assets carry that string in an HTML title. Model numbers rarely appear in titles.

A version-aware sequence that starts from outside

External measurement cannot replace an asset inventory, but it can order the work. Four steps hold up when the version question is unanswerable from outside:

  1. Baseline the exposed population weekly. Record the query string, the count and the date. A rising count after a quiet period is a change in exposure, not necessarily a change in risk.
  2. Compare against the vendor's fixed-version boundary. StoreView 4.3.1 covers all three 2025 CVEs; 4.2.4 covers only the first. If the inventory says 4.2.4, the panel carries CVE-2025-41451 and CVE-2025-41452; if it says 4.3.1, the chain demonstrated by Claroty no longer applies.
  3. Treat disconnection as a valid mitigation and a fragile one. Censys called the disconnection choice reasonable. It is also easy to reverse, often by a technician restoring remote access for support.
  4. Verify the control, not the intention. A panel removed from the internet stops appearing in a public scan. That is the only confirmation an external measurement provides, and it is worth more than a change ticket marked complete. ZoomEye's role in that sequence is step one. It is fast, it is repeatable, and it shows movement. It will not tell you whether the panel is on 4.2.4, and the moment a report implies otherwise the measurement has been misused.

The uncomfortable conclusion

Three CVEs had fixes available for over a year, and the documented response to a live incident was to unplug the affected class of equipment. That is a defensible operational decision under pressure. It is also a statement about patching capacity in cold-chain environments, where a controller reboot risks the stock in the freezer.
The measurement lesson is smaller and harder: an exposed panel is a statement about reachability, a CVE is a statement about a code defect, and only the device itself can join the two. Any report that skips that join is describing a correlation.

References

Top comments (0)