#iotsecurity

Read Time:3 Minute, 42 Second

A Fresh Look at the ExposureResearchers have identified 4,980 internet-facing hosts referencing Danfoss in their web content, according to an October 13 update from the open-source intelligence account International Cyber Digest, based on a Shodan search. The finding comes just days after attackers remotely triggered defrost functions on refrigeration systems at French supermarkets overnight between October 11 and 12, spoiling chilled and frozen stock in the process. Earlier reporting indicated affected stores saw internal temperatures climb as high as 50°C during the incident.

France accounts for the largest share of exposed hosts by a wide margin, with 2,911 results, or roughly 58% of the global total. South Africa follows with 517, then Germany with 171, Portugal with 158, and the United States with 141. Smaller numbers appear in Poland, Belgium, Sweden, Spain, and the Netherlands. International Cyber Digest estimates that around eight in ten of the identified hosts are located in Europe.

What the Numbers Don’t ProveIt is worth being precise about what a Shodan search like this actually shows. The scan looks for pages that reference Danfoss in their web content, not confirmation that every listed host is a vulnerable refrigeration controller, or that any individual system has already been compromised. A separate, more filtered search returned a slightly lower figure of 4,551 results. Neither search reveals firmware versions, confirms successful attacks against specific hosts, or indicates how many individual stores each exposed controller manages.

France Confirms Widespread CompromiseFrance’s national cybersecurity agency, CERT-FR, issued an alert on October 12 confirming numerous compromises involving Danfoss AK-SM and AK-SC refrigeration management devices, and instructed operators to immediately disconnect affected systems from the internet or restrict access through other means.

Danfoss has acknowledged that the affected refrigeration management systems were running outdated firmware, and has repeated its standing advice for customers to update supported equipment and retire legacy systems that no longer receive security patches.

A Date-Based Authentication BypassIndependent research from industrial security firm Claroty’s Team82 points to a specific weakness that may help explain how attackers gained access. The team found that the AK-SM 800A platform generates a daily administrative authentication code based on the device’s current date, meaning anyone who can reproduce the underlying algorithm could calculate a valid code and obtain an administrative session, effectively bypassing the system’s configured password entirely.

That flaw is now tracked as CVE-2025-41450, affecting AK-SM 8xxA firmware versions earlier than R4.2, which Danfoss has since patched. The U.S. Cybersecurity and Infrastructure Security Agency’s advisory also lists two related flaws in versions prior to R4.3.1: CVE-2025-41451, a command injection vulnerability in the device’s email alert settings that Team82 says could allow code execution once an attacker is authenticated, and CVE-2025-41452, a web server configuration weakness that could let an authenticated attacker manipulate how web traffic is handled or disrupt the management interface.

Investigators have not publicly confirmed that this specific vulnerability chain was what enabled the French supermarket incidents. A separate, unverified claim circulating online suggests some affected systems used a default “admin” username paired with a password that simply changes to the current date, a detail that, if accurate, would make the authentication weakness especially easy to exploit without any technical skill.

Why Centralized Refrigeration Controls Are High-RiskThe AK-SM 800A is designed to manage multiple refrigeration units through a single web interface, giving operators centralized control over temperature limits, schedules, alarms, and user accounts. That convenience is also what makes exposed management interfaces so dangerous: unlike a typical IT breach, a compromise here can directly affect physical operations, in this case the cooling systems that keep food safe for consumption.

Recommended Next StepsCERT-FR’s guidance for operators who suspect compromise includes immediately restricting network access to trusted service providers, performing a factory reset, applying all available firmware updates, rotating passwords and other credentials, auditing user accounts, and fully reconfiguring the system before reconnecting it.

Remove direct internet exposure for refrigeration and building-management controllers.

Segment operational control networks away from general business networks.

Use properly secured, authenticated remote access methods rather than open internet-facing interfaces.

Verify firmware is updated past R4.2 (AK-SM) and R4.3.1 for the related flaws before reconnecting equipment.

For retailers running similar equipment, the message is clear: patching alone is not enough if the management interface remains reachable from the open internet.

Read Time:3 Minute, 38 Second

Security researchers have tracked a sharp, nine-day spike in scanning and exploitation attempts against internet-exposed Hikvision surveillance equipment in Ukraine, with almost all of the activity aimed at a four-year-old command injection flaw that still haunts unpatched devices. The surge ran from September 21 through October 1, 2026, a period that overlapped with intensified Russian missile and drone strikes — though analysts have stopped short of linking the two.

A Sudden Spike After Months of QuietAccording to a timeline published by threat-intelligence firm GreyNoise, the activity began with low-key reconnaissance from a Ukrainian IP address on September 21, probing service ports without firing off an actual exploit. Two days later, on September 23, the picture changed: exploitation attempts shot up and continued at an elevated pace for more than a week, a level of focused attention on Ukrainian targets that hadn’t been seen in months.

Just four IP addresses were responsible for nearly all of the exploitation traffic. Three traced back to PureVPN exit nodes registered to AS56630 in Lithuania, while the fourth belonged to a domestic Ukrainian network that GreyNoise did not publicly identify. The firm assessed with low confidence that the Ukrainian address might be connected to the same operator running the VPN nodes, while cautioning that commercial VPN exits are shared infrastructure and can’t be treated as solid proof of a single actor acting alone.

An Old, Well-Known FlawThe target of nearly every attempt was CVE-2021-36260, a critical command injection vulnerability in the web server component of various Hikvision cameras and network video recorders. The bug carries a maximum-severity CVSS score of 9.8 because it can be triggered remotely, without authentication or any user interaction, letting an attacker run arbitrary commands on the device’s underlying operating system.

Notably, the attackers appear to have relied on a publicly available Nuclei scanning template built specifically to probe for this flaw. Every logged request used the same basic command test with no follow-up payload, which points toward automated vulnerability sweeping rather than a hands-on-keyboard intrusion. GreyNoise was careful to frame its findings as evidence of exploitation attempts, not confirmed device takeovers — a distinction that matters a great deal when judging how serious this specific wave actually was.

Why Exposed Cameras Are a Real RiskEven if this particular campaign turns out to be routine scanning rather than a targeted operation, the stakes around vulnerable surveillance hardware in a conflict zone are not hypothetical. Cybersecurity News has previously documented more than 80,000 exposed, vulnerable Hikvision devices discovered in a 2022 sweep, underscoring just how long this exposure problem has lingered. More pointedly, Ukrainian authorities disclosed in January 2024 that they had disabled two cameras that Russian intelligence services had compromised specifically to monitor Kyiv’s air defenses and critical infrastructure.

That history illustrates what’s plausible when a camera network goes unpatched and internet-facing — unauthorized remote command execution could, in principle, let an attacker watch live feeds, pivot into connected networks, or disable equipment at a sensitive moment. It does not, however, establish who is behind the current scanning wave or what their end goal might be.

What Operators Should DoCISA and Hikvision have both published guidance for defending against CVE-2021-36260, and the fix is straightforward even though the exposure has proven durable. Organizations running Hikvision cameras or recorders — especially in Ukraine or other high-risk regions — should treat this as a prompt to check their exposure immediately. Recommended steps include:

Identify every Hikvision camera and NVR model in the environment and confirm which firmware version is installed.

Apply Hikvision’s official firmware patches for CVE-2021-36260 without delay.

Remove direct public internet access to camera management interfaces wherever possible.

Segment surveillance equipment onto its own network, isolated from core business or operational systems.

Monitor logs for repeated connection attempts to camera web services, particularly from VPN exit ranges.

It’s worth stressing that changing device passwords will do nothing here — this is an unauthenticated flaw in how the device parses incoming requests, so a firmware update is the only real remedy. Given how often this four-year-old bug keeps resurfacing in fresh campaigns, organizations that haven’t verified their patch status recently would be wise to do so now, regardless of whether they believe themselves to be a likely target.