Multiple remote code execution vulnerabilities in danfoss sm-800A

While it's known that certifications are often just paperwork (eg. European CE mark means almost nothing imho), it does raise the question: what exact does it mean when .org/product line receives this certification? You'd expect this to be best practices, certain aspects of processes etc. With the idea that good processes produce good results. That is in direct conflict with: "It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag." If such basic / low-hanging fruit is not covered by above certification, then what on Earth is? Also: "controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance" Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

You'd expect this to be best practices, certain aspects of processes etc. With the idea that good processes produce good results. That is in direct conflict with: "It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag." If such basic / low-hanging fruit is not covered by above certification, then what on Earth is? Also: "controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance" Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

That is in direct conflict with: "It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag." If such basic / low-hanging fruit is not covered by above certification, then what on Earth is? Also: "controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance" Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

"It turns out that stack canaries and Position Independent Executable (PIE) are not enabled. These mechanisms have been staples of memory corruption defenses for decades and enabling these features on a modern Linux distribution running on a modern ARM application processor requires no engineering work at all. It is simply a matter of setting the right compiler flag." If such basic / low-hanging fruit is not covered by above certification, then what on Earth is? Also: "controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance" Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

If such basic / low-hanging fruit is not covered by above certification, then what on Earth is? Also: "controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance" Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

Also: "controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance" Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

"controllers remain exposed to the public internet. While this is for understandable reasons (supermarket chains sometimes risk SLA or insurance condition violations by taking away remote maintenance" Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

Anyone have some context as to why service and/or insurance would require remote access? Sounds beyond stupid. All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.

All in all a VERY juicy & informative read. Curious to see how Danfoss will handle this swiss cheese affair.