Hedgerow

Hedgerow-dev released coldframe, a single-file Python honeypot that impersonates Danfoss AK-SM 800A and Dixell XWEB EVO supervisors to log attacks on internet-facing refrigeration systems. It records credentials, exploit attempts and control actions without exposing real equipment.

Hedgerow-dev published coldframe, a honeypot that pretends to be supermarket refrigeration controllers and records attacks without exposing real equipment.

In 2026, attackers broke into internet-facing refrigeration supervisors across Europe using default passwords and old, unpatched firmware, then forced defrost cycles. coldframe answers that pattern by imitating two common controllers and logging every interaction.

The project is one Python file with no dependencies outside the standard library. It offers two personas: danfoss, which imitates the Danfoss AK-SM 800A system manager, and dixell, which imitates the Copeland/Dixell XWEB EVO supervisor.

The Danfoss persona copies what internet scanners record for real AK-SM 800A units: the nginx server header and header order, the Danfoss StoreView page title, TLS limited to version 1.2, and a one-year certificate for CN=DanfossSM800A issued by a SelfSigned-DanfossSM800A authority. Each build generates its own keys. Weak logins such as Supervisor / 12345 succeed, as does the correct CVE-2025-41450 "code of the day." The attacker receives a session token and a dashboard of fake refrigerated cases with defrost buttons. Every action is logged as a control event; nothing is real.

The Dixell persona follows real XWEB EVO units: no Server header, their security-header set and order, the same asset paths and page size. Its login uses the real /cgi-bin/login.lua flow. The documented factory login Admin / Admin succeeds. Five failures in five minutes lock the user. Attempts at the XWEB Pro auth_mode bypass (CVE-2026-25085) are tagged.

Real units of both vendors serve their own favicon, and scanners match devices by its hash. That icon is the vendor's artwork, so it is not in the repository. For a private deployment, operators can point FAVICON_FILE at a copy they have the right to use. The same rule applies to the Danfoss start page. Real units serve a short Angular loader page from the firmware, and thousands its exact hash. Operators can point INDEX_FILE at that index.html from the public firmware package. The decoy then serves it byte for byte, with its original date in Last-Modified and ETag. If the firmware's assets/images/Danfoss-logo.png sits beside that index.html, the page uses it.

Both personas can run an optional Modbus TCP service with fake case temperatures, setpoints and a defrost register. Real AK-SM 800A units use Modbus to talk to their own case controllers, so Modbus is off by default. Operators can turn it on to catch generic industrial scanners.

Requests that match a public exploit receive an exploit field in the log:

CVE-2023-25914: AK-SM 800A path traversal via get_file

CVE-2023-25915: AK-SM 800A command injection via load_cert

CVE-2025-41452: AK-SM 800A nginx header overwrite via load_nginx_headers

CVE-2025-41450: AK-SM 800A "code of the day" login bypass (getauth with eds_only or quantum_only), noting whether the attacker computed the correct code

SM800 code-of-the-day bypass: eds_only / quantum_only on other commands

CVE-2021-45420: XWEB 500 upload and command paths under /cgi-bin/

CVE-2026-25085: XWEB Pro login bypass via an unexpected auth_mode

For deployment, the README offers a cloud-init file for an Ubuntu 24.04 server and a container build. The cloud-init path takes two minutes after boot and places the decoy on port 80, and port 443 for the Danfoss persona. The container build creates a fresh self-signed certificate on each build, so two deployments do not one. Rootless port forwarding rewrites the source address and makes every attacker look like the same internal IP, so the documented run uses rootful Podman or Docker. The container runs as a non-root user in its own user namespace, on a read-only filesystem, with no capabilities, a 128 MB memory limit and a 512 process limit. For Modbus, operators can add -e MODBUS_PORT=5020 -p 502:5020.

Each event is one JSON line. It includes timestamp, persona, protocol, source IP and port, event type and relevant fields. Event types include any HTTP or HTTPS request, login attempts, control actions, Danfoss XML API commands, failed TLS handshakes and Modbus activity. Writes to defrost registers carry a defrost flag. summary.py turns a log into a short report.

The project says it does not run commands, read files or forward traffic. It logs and drops exploit payloads. It caps request bodies, logged fields and connections, including a per-source limit. Idle sockets time out. It cuts connections that trickle data to stay open after 30 seconds. It logs refused connections. The event log rotates once it grows large. It truncates over-long log lines. summary.py neutralizes terminal escape codes from attacker input. The container runs as a non-root user in its own user namespace, on a read-only filesystem with no capabilities. Log fields are attacker-controlled, so operators should treat them as untrusted when they view or process them.

coldframe has limits. Interaction is shallow: logged-in attackers see a small dashboard and a handful of XML commands, not the full StoreView application. Because the code is public, anyone can read the repository and spot its exact responses. The README advises changing persona strings, page layout and certificate subject for a deployment. Some details remain unconfirmed because static paths, the full web application and some XML response shapes of real units are not public. Where they were missing, coldframe uses plausible values. Cloud hosting can also raise suspicion, since some scanners flag industrial devices on cloud providers as likely honeypots.

Related work includes eppser/danfoss-ak-sm-decoy, another AK-SM decoy with SNMP and Service Tool listeners and a richer simulated store. coldframe focuses on matching real units' web fingerprints, detecting specific exploits and supporting Dixell XWEB.

coldframe is available on GitHub under the MIT license. The README cites Danfoss user guides, Synacktiv research, Claroty Team82 research, Exploit-DB, Copeland manuals and Shodan records.

Source : GitHub - hedgerow-dev/coldframe: Low-interaction honeypot for supermarket refrigeration controllers (Danfoss AK-SM 800A, Dixell XWEB 500) , by hedgerow-dev , GitHub