Skip to content
AI Exploit Demonstrates Vulnerabilities in Danfoss Refrigeration Controller

AI Exploit Demonstrates Vulnerabilities in Danfoss Refrigeration Controller

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:20 UTC
  • •Claude Sonnet 4.6 reproduced known vulnerabilities in a Danfoss controller in 28 minutes.
  • •The lab exercise demonstrated root access but did not identify the attack path in recent supermarket intrusions.
  • •Danfoss released firmware R4.3.1 to address the vulnerabilities associated with the AK-SM 800A.

Claroty reported that its AI tool, Claude Sonnet 4.6, successfully reproduced known vulnerabilities in the Danfoss AK-SM 800A refrigeration controller during a guided lab exercise. The test took 28 minutes and cost approximately $6 in AI usage. The vulnerabilities involved include CVE-2025-41450 (authentication bypass), CVE-2025-41451 (command injection), and CVE-2025-41452 (Nginx configuration injection). Although the exercise demonstrated root access on the lab device, it did not identify the attack path used in recent intrusions affecting over 400 French supermarkets. Claroty emphasized that the test reproduced previously disclosed flaws and did not discover new vulnerabilities. Danfoss has released firmware R4.3.1 to address these vulnerabilities. The precise method of exploitation in the supermarket incident remains unconfirmed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-05-08
CVE-2025-41450 published
An authentication bypass vulnerability affecting the Danfoss AK-SM 800A was disclosed.
Neoteo
2025-08-22
CVE-2025-41451 and CVE-2025-41452 published
Command injection and Nginx configuration injection vulnerabilities were disclosed for the same device.
Neoteo
2026-10-12
Attacks on French supermarkets reported
Claroty noted that over 400 French supermarkets were affected by attacks, but the route used by intruders was unconfirmed.
Neoteo
2026-10-13
Claude's lab exercise completed
Claroty reported that Claude reproduced vulnerabilities in a Danfoss controller, achieving root access.
Neoteo

More articles in this cluster (2)

Following this threat?

Track Claroty and CVE-2025-41450 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 4

Common questions

What vulnerabilities were demonstrated?
The vulnerabilities include CVE-2025-41450 (authentication bypass), CVE-2025-41451 (command injection), and CVE-2025-41452 (Nginx configuration injection).
Is there a patch available?
Yes, Danfoss released firmware R4.3.1 to address the vulnerabilities in the AK-SM 800A.
What is the current status of the supermarket attacks?
The precise attack path used in the supermarket incidents remains unconfirmed, but over 400 locations were reported affected.