Loading vulnerability…
Date-based authentication bypass in Danfoss AK-SM 8xxA
CVE-2025-41450 is an improper authentication vulnerability affecting Danfoss AK-SM 8xxA Series refrigeration controllers running firmware earlier than R4.2. An undocumented alternative authentication path invokes check_code_of_day and accepts an authentication code derived solely from the device's current date instead of the configured administrator password. An attacker who reproduces the code-generation algorithm and supplies the required authentication request attributes can obtain a fully authenticated administrative session. The vulnerability permits unauthorized management access and disclosure of sensitive controller and deployment information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses administrator authentication and exposes refrigeration-management functionality. An attacker can generate a web report disclosing internal network addresses, usernames, store names, and other sensitive information. Administrative access can also enable unauthorized changes to refrigeration settings, schedules, alarms, and accounts, potentially disrupting cooling operations. Chaining this vulnerability with CVE-2025-41451 enables remote code execution; code execution is not a direct consequence of this vulnerability alone. Exploitation of this CVE in the October 2026 supermarket incidents has not been publicly established.
If you can’t patch tonight, do this now.
Remove direct internet exposure and restrict management access to trusted administrative networks or secure, up-to-date VPN gateways. Place controllers behind default-deny firewalls, restrict permitted sources, and segment control systems from business networks. Require named identities and multifactor authentication at the remote-access gateway, and monitor administrative sessions and refrigeration-setting changes. These controls reduce exposure but do not correct the authentication flaw; changing the normal administrator password alone does not remove the alternative login path. The vendor advisory provides no vulnerability-specific workaround.
Patch, then assume compromise.
Upgrade affected Danfoss AK-SM 8xxA controllers to firmware R4.2 or later, which addresses the date-based authentication weakness. Prefer the latest vendor-supported firmware appropriate for the device model; R4.3.1 or later also addresses the related CVE-2025-41451 and CVE-2025-41452 vulnerabilities. Follow the vendor's software-upgrade procedure and assess operational impact before deployment.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.