Dsa 2026 08 01

www.danfoss.com • October 12, 2026

Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 Hybrid software

Advisory ID: DSA-2026-08-01

CVE numbers and CVSS scores CVE number: CVE-2026-15203 CVSS:9.3

CVE number: CVE-2026-15203

Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 software expose debug interfaces by default, allowing unauthorized access to internal data, uploading unsigned applications, and modifying firmware.

Affected products and services

Danfoss iC7-Automation SP prior to version 2025.3.3

Danfoss iC7-Marine prior to version 2025.8.19

Danfoss iC7-Hybrid prior to version 2025.10.300845

Vulnerability description

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms.

iC7-Automation SP: (Release 2026.2.5-26A)

iC7-Marine: (Release 2026.6.30-GR4.4)

iC7-Hybrid: (Release 2026.7.2-GR4.5)

Credits (if opted in)

18 September, 2026: Publication

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattack on French Supermarkets Spoils Food by Heating Refrigerators A significant cyberattack occurred on October 11-12, 2026, targeting refrigeration systems at over 300 French supermarkets, including Intermarché, Coopérative U, and E. Leclerc. Hackers manipulated the systems to raise temperatures to 50°C (122°F), leading to extensive food spoilage and fires. The attack exploited vulnerabilities in outdated Danfoss refrigeration controllers, specifically the AK-SM800 and AK-SC355 models, which had not received security updates. Paris prosecutors have opened an investigation into the incident, which has been described as unprecedented and extremely serious by industry leaders. Initial estimates suggest losses could reach tens of millions of euros across the affected chains. The attack has raised concerns about the security of operational technology in the food supply chain. 77 sources 70

Extracted Entities

Companies (1)

Danfoss

CVEs (1)

CVE-2026-15203