French supermarkets had a bad weekend: on the night of 11 October attackers took over Danfoss refrigeration controllers at hundreds of stores, putting units into defrost and pushing them as high as 50°C, and Intermarché, Netto, Carrefour, Monoprix, E.Leclerc and Coopérative U all reported hits. It is tempting to connect this to Claroty Team82’s August research on the AK-SM 800A: an authentication bypass via a date-derived “code of the day” (CVE-2025-41450, fixed in 4.2 per DSA-2025-03-01), plus a command injection and a configuration flaw (CVE-2025-41451, CVE-2025-41452) fixed in R4.3.1. But nobody has said how the attackers got in, Danfoss has linked none of those CVEs to the attack, and none of them is in KEV. CERT-FR’s alert names no vulnerability either, adds Copeland and Dixell xweb controllers to the list, and boils down to: get the management interfaces off the internet. The controllers mostly hit were the AK-SM 800, end-of-life since 2021, and the AK-SC 355, phased out in 2016, for which Danfoss no longer issues fixes at all. For most of the hit units the problem isn’t a patch nobody applied; it’s that there is no patch to apply, and the fix for an end-of-life fridge controller turns out to be a new fridge controller.
