CVE-2025-41450

The AK-SM 8xxA is a controller that runs refrigeration, cooling, and climate systems, often used in supermarkets, cold storage, and food service. This flaw is like a back door that lets someone get in and take over the controls without actually knowing the password, giving them the ability to disrupt or damage whatever the system manages, such as refrigeration temperatures.

This matters to you if you operate or maintain a Danfoss AK-SM 8xxA Series controller, commonly found managing refrigeration or building climate systems in supermarkets, cold storage facilities, or commercial kitchens. It affects versions prior to 4.2. The risk is highest if the controller's management interface is reachable from the internet or an untrusted network.

This is rated urgent: the flaw carries a high severity score, grants full privileged control when exploited, and has drawn sustained press attention tied to a reported real-world incident. No confirmed mass exploitation or public attack code exists yet, but given the severity and the fact a fix is already available, this should be treated as a near-term priority rather than something to schedule for later.

1. Inventory all AK-SM 8xxA controllers and record their current firmware/software version. 2. Confirm exposure: check whether the controller's web/management interface is reachable from the internet or any network segment not tightly controlled (remote monitoring setups are a common exposure point for this product line). 3. As an immediate mitigating step if patching cannot happen right away, restrict network access to the controller's management interface to a trusted management VLAN or VPN, and disable any remote/internet-facing access. 4. Upgrade to version 4.2 or later, the vendor-confirmed fix; review Danfoss release notes for any migration or configuration steps tied to the upgrade. 5. After upgrading, rotate all administrative and user credentials on the device, since the bypass could have allowed unauthorized configuration changes prior to the patch. 6. There is no CISA KEV entry and no due date mandated, but given the CVSS 8.2 score and sustained incident-related press coverage, prioritize this within normal high-severity patch SLAs. 7. Monitor device logs for unexpected configuration changes, new admin accounts, or unusual login patterns, and monitor vendor advisories for any follow-up guidance.

CVE-2025-41450 is an improper authentication vulnerability (CWE-305) in Danfoss AK-SM 8xxA Series prior to 4.2, scored CVSS 3.1 8.2 (High), vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H — network-exploitable, high attack complexity, no privileges required, but requires user interaction, with a scope change and high confidentiality/availability impact plus limited integrity impact. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploit code or proof-of-concept is currently on record. Predicted exploitation likelihood (EPSS) is low with a flat trend, indicating mass automated exploitation is not currently anticipated, though sustained press coverage tied to a reported incident suggests targeted interest. The vendor has released fixed firmware in version 4.2.