Tens of Millions of Euros in Losses in France: How Can Danfoss Controllers Be Exploited? Does the Company Bear Any Responsibility? Is AI Enabling the Weaponization of Publicly Available Information?
In light of the recent attacks on refrigeration systems in supermarkets across nine European countries, as well as on several blood banks in France, it would be prudent for cybersecurity professionals to analyse the factors that may have been involved, in order to identify valuable lessons.
According to Euronews:
“Hackers exploited weak cybersecurity and vulnerabilities in manufacturer Danfoss’s AK-SM refrigeration system manager to put fridges and freezers on defrost settings, in some cases temperatures were set as high [as] 50 degrees Celsius”.
In the first wave, which affected hundreds of French supermarkets on the night of 11–12 October, Danfoss stated that the compromised devices were primarily end-of-life AK-SM 800 and AK-SC 355 controllers, which no longer receive security updates, along with some current AK-SM 800A units running outdated firmware.
This write-up is intended solely for educational purposes and should not be read as a step-by-step guide to carrying out such attacks. Rather, it aims to offer a novel perspective, illustrated through a high-profile case, on how artificial intelligence can be leveraged to weaponize publicly available vulnerability information.
How Did the Attackers Reach the Controllers?
Although the initial access vector remained uncertain at the time of writing, one fact is clear: thousands of Danfoss controllers are exposed to the internet, some of which may be running outdated firmware or end-of-life models.
According to data from the Shodan and Censys search engines, France accounts for the majority of these exposed devices. Because these controllers are usually administered remotely by third-party refrigeration service providers, internet-facing access has become standard practice, which helps explain the scale of the exposure.
Accordingly, the analysis that follows focuses on this attack surface.
The Known Vulnerabilities
On 9 August 2026, Amir Zaltzman of Claroty Team82 published research describing three vulnerabilities in the Danfoss AK-SM 800A refrigeration controller, all of which have since been patched: a hidden “code-of-the-day” authentication bypass (CVE-2025–41450), a command injection flaw in the SMTP email password field that enables post-authentication remote code execution (CVE-2025–41451), and an Nginx configuration injection that causes denial of service (CVE-2025–41452). Notably, although the author states that the team fully reconstructed the date-based daily password algorithm, the publication does not explain it, redacts the two request attributes required to trigger the bypass, and includes no working exploit payload.
On 13 October 2026, Claroty published a follow-up article in which Zaltzman reports that:
“Using Anthropic’s Claude Sonnet 4.6 in medium reasoning mode through the Cursor AI-native code editor, we reproduced the vulnerabilities and chained two to achieve root-level command execution on a lab device”.
However, the author also acknowledges that:
“The agent initially reproduced two vulnerabilities (CVE-2025–41451 and CVE-2025–41452) but failed to correctly analyze the authentication bypass (CVE-2025–41450), confidently pursuing an incorrect approach”.
It is at this point that an advisory published by Synacktiv becomes relevant.
Synacktiv Warned in 2023: Did Danfoss Overlook the Vulnerability?
In 2023, Synacktiv published a security advisory describing how Danfoss SM800 and SC255 system managers (firmware version 08.095.008 and earlier) accept a hidden code_of_day password derived solely from the current date. Because the device discloses its date without requiring authentication, any attacker can compute this password and gain access to authenticated functionality. The advisory thus describes the very mechanism the AI agent failed to identify on its own, effectively supplying the answer that Claroty’s experiment required human guidance to reach.
More significantly, this suggests that Danfoss carried a publicly reported class of weakness into a newer product line. The company’s publicly accessible firmware repository (https://sm800a.danfoss.com/sw_shared/) shows that, between Synacktiv’s advisory in February 2023 and version 4.2, the last version affected by CVE-2025–41450, Danfoss released several firmware updates for the AK-SM 800A. Taken together with Claroty’s findings, this indicates that the AK-SM 800A, a product actively sold and supported worldwide, continued to ship with an authentication weakness resembling one already publicly documented in older, end-of-life models since 2023.
The Role of AI
Claroty’s article on the use of AI stated that:
“We redirected the investigation and provided a Ghidra Model Context Protocol (MCP) integration for targeted decompilation and cross-reference analysis of the controller’s 67 MB main application binary. Ghidra is a reverse-engineering platform.”
This statement suggests that the LLM, operating independently, was not entirely effective and required substantial human guidance from skilled investigators.
Although Claroty’s conclusions are valid, they raise three important research questions: Could an AI model independently reproduce an already documented vulnerability if provided with the publicly available 2023 report? How much human guidance would be required to achieve this? Can we leverage AI to reverse-engineer firmware and increase the chances of success?
To investigate these questions, two experimental scenarios were considered:
Public-information-only scenario: Providing the LLM with the publicly available CVE description and the 2023 technical report, without additional reverse-engineered information.
Reverse-engineering-assisted scenario: Providing the LLM with the same publicly available information, supplemented by the reverse-engineered algorithm used by the controller to generate executable code.
The purpose of this comparison is to complement Claroty’s research by assessing the extent to which publicly available information alone enables an AI model to reproduce a documented vulnerability, identifying what additional information Claroty’s model required to successfully reproduce it, and determining how access to further reverse-engineered technical information affects the model’s capabilities and the degree of human intervention required.
Reverse-Engineering the Firmware
Since Danfoss makes its firmware publicly available through its software repository , even an inexperienced attacker could download the firmware and use AI assistance to analyse it. This process relies entirely on static firmware reverse-engineering and does not require executing the firmware or interacting with the target device.
Although this process would traditionally require a certain level of reverse-engineering expertise and potentially considerable time, the task was completed in a matter of minutes with the assistance of claude-opus-4-8. This demonstrates once again how AI can significantly reduce the technical expertise and time traditionally required to analyse publicly available firmware, potentially lowering the barrier to entry for individuals seeking to identify and reproduce vulnerabilities in industrial control systems.
After extracting the nested .spk package and 7-Zip archive to obtain the ARM binaries, the relevant algorithm can be identified through static binary analysis. The availability of DWARF debugging information and retained symbol names makes it possible to locate the target function check_code_of_day through symbol-table and debug-information searches, trace its callers and cross-references, and examine its implementation through disassembly into assembly language.
Developing the Exploit
To evaluate whether an LLM could autonomously develop an exploitation tool using publicly available information about the vulnerability, DeepSeek-V4.1-Flash-1017 was provided with Synacktiv’s published findings and the corresponding CVE description.
To constrain the experiment and ensure that the results reflected the model’s ability to reason from the supplied information, explicit instructions were given to prevent further research or retrieval of external information concerning the vulnerability. The model was therefore restricted to the provided materials (as much as possible).
The objective was to determine whether the model could autonomously, without human intervention or additional guidance, produce a Python script capable of targeting a URL hosting vulnerable Danfoss firmware and exploiting the identified authentication bypass.
How the Algorithm Influenced the Results
Both LLM sessions successfully produced a Python script. However, the reasoning process and the resulting approach differed considerably depending on whether the reverse-engineered authentication algorithm was provided.
In the absence of the algorithm, the model’s uncertainty primarily concerned the underlying communication protocol. With limited information about the authentication mechanism, it attempted to compensate by exploring multiple possible request structures and protocol variations.
When provided with the reverse-engineered algorithm, the model’s reasoning shifted towards reconciling two partially conflicting descriptions of the same function. Rather than treating the published findings as an unquestionable specification, it compared the documented pseudocode against the decompiled implementation and ultimately favored the latter. This process also prompted additional scrutiny of the underlying arithmetic operations, revealing subtleties involving hexadecimal versus decimal parsing.
An important distinction emerged between the two experiments: the second session had an additional source of information against which it could validate and challenge the first. This made it possible to identify and investigate an inconsistency that the first session had no means of detecting, as it had no independent implementation reference against which to compare Synacktiv’s documented pseudocode.
These observations suggest that providing reverse-engineered details can have a dual effect: it reduces the effort required for an LLM to implement an exploitation technique, while also providing additional technical context that can improve its ability to identify inconsistencies and refine its implementation.
When run against the target in the lab environment, the script generated by the LLM that possessed the reverse-engineered artifact successfully authenticated.
Here’s The Code, Now What?
If properly instrumented, an attacker who successfully authenticates using the daily code can subsequently invoke the get_file command to retrieve database or configuration files from the device through the same /xml.cgi endpoint.
For example:
An attacker can retrieve a sensitive file that is only Base64-encoded, allowing its contents to be trivially decoded without requiring any significant effort.
Since Claroty’s article focuses on the web interface, we will also direct our attack towards this entry point. The web panel, used by technicians for maintenance purposes, can be accessed by providing a username and password combination.
This authentication mechanism can also be bypassed by abusing the Code of the Day feature. To investigate this attack vector, an HTTP proxy such as Burp Suite can be configured to intercept communications between the browser and the device.
Upon submitting a username/password combination (e.g., test:test), the browser sends an HTTP POST request to the device. This request can then be intercepted and inspected, allowing us to examine the authentication parameters and identify the relevant fields to modify.
POST /xml.cgi HTTP/1.1
Host: localhost
Content-Length: 151
Sec-Ch-Ua-Platform: “Linux”
Accept-Language: en-GB,en;q=0.9
Accept: application/json, text/plain, */*
Sec-Ch-Ua: “Chromium”;v=”143”, “Not A(Brand”;v=”24”
Content-Type: text/plain
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin: https://localhost:444
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://localhost:444/
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
AKSM-auth: 01-01
xml=%3Ccmd%20user%3D%22test%22%20password%3D%22test%22%20action%3D%22getauth%22%20storeview_only%3D%221%22%20version%3D%22C%22%20lang%3D%22eng%22%2F%3E
By modifying the xml parameter in the intercepted POST request and replacing its original value with the generated payload (including the generated code day), an attacker can bypass the web panel’s standard username/password authentication mechanism.
The following URL-encoded XML payload illustrates the modified request, where the code of the day is 02605:
xml=%3Ccmd%20action%3D%22getauth%22%20eds_only%3D%221%22%20password%3D%2202605%22%20version%3D%22C%22%20lang%3D%22eng%22%2F%3E
An attacker who has successfully authenticated can access sensitive information and potentially proceed to exploit CVE-2025–41451, which can lead to remote code execution.
Key Takeaways
Reaching this stage does not, by itself, reproduce the full attack method or the cyber incidents previously reported. Several additional steps are required to chain vulnerabilities and achieve the resulting mass impact. Nevertheless, the fundamental milestone of circumventing the system’s authentication defenses has already been achieved.
This write-up aims to highlight a broader security concern: techniques that previously required highly specialized knowledge, substantial reverse-engineering expertise and potentially the collaboration of multiple individuals can increasingly be reproduced by leveraging publicly available CVE documentation, even when that documentation is incomplete or omits important implementation details.
Claroty’s experiment demonstrates that the AI agent initially struggled to reproduce the authentication bypass using the information and tools available in its initial investigation. However, Synacktiv’s publicly available 2023 advisory contained additional technical information concerning a similar authentication mechanism, the check_code_of_day()function. This raises an interesting research question: whether providing an AI model with previously published vulnerability research can substantially reduce the human intervention required to reproduce an analogous vulnerability in a newer product generation.
The implications extend well beyond the specific devices examined in this research. Many critical and operationally important environments rely on embedded controllers built around similar architectural principles. These include HVAC and building management systems, cold-chain logistics, pharmaceutical and hospital storage facilities, lighting and access control systems, elevators, water and wastewater pumping stations, EV chargers, solar inverters, and industrial process controllers.
Such systems frequently rely on embedded devices that may be remotely accessible, receive infrequent security updates, and remain operational long after their manufacturers have discontinued software maintenance.
Ricardo Silva, 2026
Top comments (0)