MediumPublic exploitVulnerability

CVE-2025-41452

Authenticated Nginx Configuration Injection in Danfoss AK-SM 8xxA

Published Aug 22, 2025 · Updated 8 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

23 mentions · peak 8 in a dayToday

CVSS6.8Medium · v4

EPSS0.92%60th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

IdentifiersCVE-2025-41452CWE-15 · External Control of System or…

CVE-2025-41452 is a post-authentication configuration-injection vulnerability in Danfoss AK-SM 8xxA Series refrigeration controllers running firmware earlier than R4.3.1. The load_nginx_headers action accepts an authenticated configuration upload and reloads the externally exposed Nginx instance, allowing an attacker to inject arbitrary configuration directives. Injected routing directives can alter web request handling. Requests to a maliciously configured route can trigger an unhandled exception in the controller's web application, terminating the web service and causing repeatable denial of service against the management interface.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can make the controller's web management interface unavailable, disrupting remote administration and monitoring. Arbitrary Nginx configuration directives can also alter routing and web traffic handling, potentially affecting clients interacting with the controller. Remote code execution, direct manipulation of refrigeration settings, and physical equipment damage are not established consequences of this vulnerability alone. Exploitation of this CVE in the October 2026 supermarket incidents has not been confirmed.

Mitigation

If you can’t patch tonight, do this now.

Danfoss does not provide a vulnerability-specific workaround. Reduce exposure by removing direct public access to management interfaces, restricting administration to trusted management networks or secured VPN connections, placing controllers behind firewalls, and isolating control-system networks from business networks. Apply least-privilege administrative access, individual accounts, and multifactor authentication at the remote-access gateway. Monitor configuration changes and management-service interruptions. These controls reduce exposure but do not replace the firmware update.

Remediation

Patch, then assume compromise.

Upgrade affected Danfoss AK-SM 8xxA Series controllers to firmware R4.3.1 or a later supported release using the vendor's AK-SM 800A software upgrade process. Verify model compatibility and any intermediate upgrade requirements before installation, and confirm the installed firmware version afterward.

Public exploits

Exploits

1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.

View more in app →

fromagegateStandalone Python-standard-library research and detection toolkit with 15 files: three exploit scripts, one vulnerable-behavior emulator, one detection-test script, four experimental Sigma YAML rules, one Suricata ruleset containing nine rules, two capture/proof artifacts, two Markdown documents, and .gitignore. The five Python scripts are counted as code files; the detection rules are declarative artifacts, not an exploit-framework dependency. CVE-2025-41450 is modeled through an MD5-based, six-digit date code and stand-in codeofday/support fields that yield an SMSession administrator cookie. CVE-2025-41451 submits a configurable shell payload in SMTP password item 0x1be1; its default writes id output to a proof file. CVE-2025-41452 uploads a fixed headers.conf marker and location, verifies the injected response header, then checks a simulated 502-to-503 crash sequence. Only the command-injection script supports legitimate credentials despite broader wording in the README. The emulator intentionally permits local command execution, while nginx behavior is simulated by parsing directives rather than running nginx; its crash window is eight seconds. The provided nine-request capture documents an emulator chain, and the identity proof originates from a macOS host. Neither establishes exploitation of real Danfoss firmware. The repository explicitly acknowledges that the true date-code algorithm and bypass names are missing and that request schemas need device validation. These are genuine functional emulator PoCs, not demonstrated turnkey hardware exploits. Detection coverage includes authentication anomalies, shell-injection request patterns, headers.conf uploads, web-service child processes, nginx reloads, HTTP 503 bursts, and StoreView exposure. The test script is an approximate request matcher, not a Suricata engine test; response-side rules are not exercised, and Sigma rules are not validated by it. Placeholder SMTP addresses are configuration artifacts, not demonstrated attacker infrastructure. Reference URLs are documentation links, not runtime endpoints. WRITEUP.md supplies incident context but explicitly treats attribution to these CVEs as inference; its incident claims were not independently verified. The writeup and emulator source are partially truncated in the supplied material. Repository URL, git reference, archive path, and archive size were not supplied; empty strings, null, and size 0 represent unavailable metadata.msuiche · Disclosed Oct 13, 2026 · python · network · webOperational

External references

References

MITRE CVEcve.org · CVE-2025-41452 NVDnvd.nist.gov/vuln/detail/CVE-2025-41452 MITRE CWE · CWE-15External Control of System or Configuration…github.comgithub.com/msuiche/fromagegate danfoss.comdanfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a

Activity feed

Recent activity

31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

hackreadNews · Oct 26, 202612,976 Refrigeration Controls Found Exposed Online in 99 CountriesAn authenticated vulnerability affecting Danfoss AK-SM 8xxA systems running versions before 4.3.1 that could cause denial of service through web-interface configuration changes. The article does not establish that this vulnerability was used in the reported refrigeration attacks.Read more ↗dark readingNews · Oct 22, 2026Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jourOne of three patched vulnerabilities in Danfoss AK-SM 800A refrigeration controllers disclosed by Claroty Team82. The vulnerabilities collectively allow remote code execution or denial of service, but the article does not map those effects to individual CVEs. Although discussed in connection with supermarket refrigeration sabotage, this specific vulnerability is not confirmed as the attack vector.Read more ↗forescoutNews · Oct 22, 2026Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk - ForescoutA known vulnerability affecting Danfoss AK-SM 800A firmware before version 4.3.1. Researchers identified 3,762 StoreView service observations, approximately 80% of the total, running firmware below that threshold. The content does not establish exploitation of this vulnerability or describe its technical mechanism.Read more ↗fortinet threat signalNews · Oct 21, 2026Threat Signal Report | FortiGuard LabsA web server configuration vulnerability affecting Danfoss AK-SM 8xxA refrigeration controllers that can cause denial of service. Danfoss identifies firmware R4.3.1 as the fix. The report does not attribute the supermarket compromises to this specific vulnerability.Read more ↗

+16 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity9Community discussion across Reddit, Mastodon, and other social sources.