Comment by interloxia
8 hours ago
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers Amir Zaltzman / August 9th, 2026
https://claroty.com/team82/research/freeze-the-controller-de...
8 hours ago
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers Amir Zaltzman / August 9th, 2026
https://claroty.com/team82/research/freeze-the-controller-de...
We all know the saying: The S in IoT stands for secure.
A quick search puts the list price of the touchscreen-equipped controller at around €7,000 [1]. So this is hardly the typical dirt-cheap IoT device you can buy for a few bucks from China. The product label also says "Made in Denmark."
This vulnerability certainly appears more complex to exploit than the ones routinely found in cheap IoT devices.
Still, I wonder why, in the age of Tailscale and Nebula, a large company like Danfoss doesn’t use overlay networks to make these services accessible only to technicians and other authorized personnel, rather than exposing them publicly. From a technical standpoint, a company with 40,000 employees should be capable to pull this off.
[1] https://www.lefroid.fr/fr/c/p/402785
>The product label also says "Made in Denmark.
That label only means most of the final assembly process have been completed in Denmark, it doesn't mean all HW & firmware inside of it have been developed in Denmark by vikings.
A lot of HW & FW by EU companies whose main specialty isn't HW and FW, tends to be outsourced to third party consultancies (sometimes even offshored), who won the bid to do it as cheap as possible, so you never know what quality you're gonna get inside of it, despite the provenance label.
One of the biggest scams right now is the Made in Germany label on cars/household appliances, which isn't in any way an indicator of quality like it used to be.
I promise I'm not simping for Danfoss, just because I'm danish, but... Is it really their fault the customers aren't putting these things behind VPN? Yes, the thing should be secure ideally, but why take the risk?
Agreed, it's not necessarily Danfoss's fault. The customer bought the appliance and is free to do whatever they want with it, that's what ownership is about and I fully support this. But in a situation like this, who bears responsibility? The customer whose appliance is exposed to the internet, likely having been installed by an authorized technician in the first place, or Danfoss, whose now-insecure maintenance interface listens on 0.0.0.0? I don't have an answer.
As others have pointed out, this interface is intended for use by service personnel.
My point is simply that situations like this can be prevented in several ways: on the customers side, if they have a capable IT department, or on the vendors side, by designing with the expectation that some customers will inevitably expose devices to the internet, regardless of what the manuals and training materials say.
This is a great find, would be nice for it to be mentioned in the original article. It all worked out just like the title says. I guess someone didn't upgrade their firmware in time.
The security advisory linked in that article was published in August 2025. Apparently it took about a year to finish the writeup. Unless the supermarket also spent about a year without upgrading the firmware, it might be a newer vulnerability.
Thanks for pointing this out, I hadn't noticed that. I'd expect a large customer to be persuaded by Danfoss to upgrade within a year, especially before publishing the details of the vulnerability, so you're probably right.