Dsa 2025 03 01

www.danfoss.com • October 13, 2026

Improper Authentication vulnerability in Danfoss AK-SM8xxA Series, resulting in an authentication bypass

Advisory ID: DSA-2025-03-01

CVE numbers and CVSS scores CVE-2025-41450 Base Score: 8.2 (HIGH)

CVE-2025-41450 Base Score: 8.2 (HIGH)

Improper Authentication vulnerability in Danfoss AK-SM8xxA Series, resulting in an authentication bypass. Install the latest patch with number 4.2 to remediate this vulnerability.

Affected products and services

Danfoss AK-SM 8xxA Series prior to version 4.2

Vulnerability description

CVE-2025-41450 - Improper Authentication vulnerability in Danfoss AK-SM8xxA Series. Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information. Problem Type: CWE-305: Authentication Bypass by Primary Weakness

Install the latest software version through AK-SM 800A Series | Danfoss .

Credits (if opted in)

Tomer Goldschmidt (Claroty Team82)

1 September, 2025: Updated the classification of Problem Type for improved accuracy and tracking

24 March, 2025: Publication

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattack Heats French Supermarket Refrigerators to 50°C, Causing Food Loss On October 11-12, 2026, a cyberattack targeted the refrigeration systems of hundreds of French supermarkets, including Intermarché, Coopérative U, and Carrefour. Attackers exploited vulnerabilities in Danfoss controllers, raising temperatures to 50°C (122°F) and triggering extensive food spoilage and some fires. The attack affected over 300 Intermarché and Netto stores, with significant losses estimated in the millions of euros. The Paris Prosecutor's Office has launched an investigation into the incident, while France's National Cybersecurity Agency (ANSSI) is assessing the vulnerabilities exploited. The compromised systems primarily included outdated models that no longer received security updates, highlighting the risks associated with legacy technology. No group has claimed responsibility for the attack, and investigations are ongoing. 47 sources 71

Extracted Entities

CVEs (1)

CVE-2025-41450

Platforms (2)

Danfoss Ak-sm 800A Series Danfoss AK-SM8xxA Series