New critical 0-day RCE flaws found in Danfoss fridge controllers, despite previous attacks

Researchers have discovered six new pre-authentication remote code execution vulnerabilities in the latest firmware version of Danfoss AK-SM800A refrigeration controllers. This follows multiple documented attack waves on these systems since October 2024, which exploited previously disclosed trivial flaws like authentication bypasses and command injections. Hundreds of Danfoss, Copeland, and Eliwell refrigeration control systems remain exposed to the public internet.

Despite vendor guidance focusing solely on patching, the discovery of new 0-day RCEs in the most recent firmware demonstrates that the fundamental security posture of these industrial controllers remains critically weak. Asset owners must assume these systems are actively targeted and move beyond patching to isolate them from the internet, as remote code execution on refrigeration controllers can cause massive operational and financial damage.