News.Lavx.Hu Coldframe Honeypot Mimics Supermarket Refrigeration Systems to Log Attacks
Article Content
- •Coldframe is a honeypot that simulates supermarket refrigeration controllers.
- •It logs attack attempts and exploits without exposing real systems.
- •The tool recognizes multiple CVEs related to the targeted systems.
In 2026, attackers exploited internet-facing refrigeration supervisors in Europe, using default passwords and outdated firmware to initiate unauthorized defrost cycles. In response, Hedgerow-dev released Coldframe, a Python-based honeypot that impersonates Danfoss AK-SM 800A and Dixell XWEB EVO controllers. Coldframe logs attack attempts, including credential submissions and exploit usage, without exposing real equipment. It features two personas that mimic real devices, allowing attackers to interact with a fake dashboard while all actions are recorded. The honeypot recognizes several CVEs, including CVE-2025-41450 and CVE-2026-25085, and provides a controlled environment for monitoring attack patterns. This tool aims to help security professionals understand and mitigate threats against industrial control systems.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Ubuntu and CVE-2021-45420 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What systems does Coldframe simulate?
How does Coldframe log attacks?
What CVEs does Coldframe recognize?
Continue Reading
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects… 
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…