Multiple remote code execution vulnerabilities in danfoss sm-800A

The piece examines the security of Danfoss AK-SM800A refrigeration controllers amid waves of attacks on internet-exposed commercial fridge systems. Those attacks reportedly triggered defrost cycles, causing major food losses and fires. Although remote access can be operationally necessary, the central argument is that changing passwords and applying patches are not enough: owners should remove direct internet exposure, using measures such as VPNs, private APNs, or tightly restricted IP allowlists. The concern extends beyond Danfoss, since many controllers from several vendors remain publicly reachable.

A firmware review of the AK-SM800A version 5.3.2 found six previously undisclosed, pre-authentication stack-based buffer overflows, reportedly in less than an hour of manual inspection. The researcher used firmware emulation to examine the web-facing application, where extensive use of unsafe string-copying functions exposed unauthenticated request handlers to memory corruption. The device’s software also lacks stack canaries and position-independent execution, weakening defenses against exploitation. The vulnerabilities could enable complete device takeover, persistent access that may survive a reset, or lasting denial of service. Technical details and identifiers are being withheld during coordinated disclosure, but the findings underscore the risk of treating patches as sufficient protection - especially given earlier Danfoss authentication bypass, command-injection, and path-traversal flaws, and recent real-world targeting.