Danfoss AK-SM800A Zero-Days: Isolate Refrigeration Controllers First

The short answer: isolate first, then assess

On 13 November 2026, Ireland’s National Cyber Security Centre (NCSC) published advisory #2611130306 describing six previously unknown pre-authentication remote code execution vulnerabilities in Danfoss AK-SM800A refrigeration controllers. Firmware up to and including 5.3.2 is affected. At publication, the issues had no CVE identifiers and no patches were available. The NCSC says an attacker could gain full control without valid credentials. Read the NCSC advisory for the affected product and immediate recommendations.

For operators, this changes the priority. Do not treat a routine firmware check or password reset as sufficient protection while a controller remains reachable from the public internet. First remove unnecessary exposure, then provide tightly controlled maintenance access and verify that the refrigeration process has not been altered.

What the new research says—and what it does not

The research by Midnight Blue describes six stack-based buffer overflow vulnerabilities in the AK-SM800A. The affected paths are reachable before authentication, and the researchers report that the issues remain in firmware through version 5.3.2. Detailed technical information is being withheld while coordinated disclosure with the vendor continues. Read the researcher’s technical summary.

Separate the new vulnerability scope from the wider incident scope. The NCSC identifies AK-SM800A firmware up to 5.3.2 for the six newly reported flaws. Its advisory also names Danfoss AK-SC and AK-SM series and Copeland/Dixell XWEB products in the wider threat picture. France’s CERT-FR separately reports compromises involving those controller families. That does not establish that the six new AK-SM800A vulnerabilities affect every model in the other families. CERT-FR’s alert lists the controller families and recovery guidance.

Why a refrigeration controller is a critical OT asset

A refrigeration controller can influence temperature setpoints, compressor operation, defrost schedules, alarms and remote monitoring. If an attacker changes a setting or interferes with monitoring, the result may be spoiled food or medicine, damaged equipment, interrupted distribution or unsafe storage conditions. The FBI and US government partners warn that malicious actors are targeting unpatched or internet-accessible refrigeration and cold-chain controllers globally, including systems used in food, healthcare and transport. The FBI and partners’ advisory describes the operational risks and mitigations.

This applies beyond supermarkets. Indian operators should consider cold-storage warehouses, dairy and food-processing plants, pharmaceutical distribution, hospitals, laboratories and refrigerated transport. Remote access is often installed by an equipment supplier or contractor. A cellular router, service-provider modem or cloud relay may not appear in the organisation’s normal IT inventory.

Priority 1: remove direct internet exposure

Inventory the route used to reach each controller—not just its IP address. Include devices connected through third-party networks and mobile links. The Greek National Cybersecurity Authority said on 3 November that it had identified more than 300 exposed systems in Greece, mainly commercial refrigeration controllers from several manufacturers. This illustrates how supplier-managed connections can become an overlooked attack surface. Its recommendations include removing public exposure, VPN access with multifactor authentication, changing default passwords and replacing unsupported equipment.

• Record the manufacturer, model, serial number, firmware, site, support status and business owner for every controller.
• Map access paths: public IPs, port forwards, cellular routers, private APNs, vendor portals and contractor VPNs.
• Remove direct inbound access from the public internet to management interfaces. Do not rely on an obscure port or hidden URL.
• Place controllers in a dedicated OT zone. Permit only required communications to monitoring, engineering and service systems.
• Use passive discovery or approved records first. Do not actively scan live controllers without a safety plan and vendor/operator approval.

Priority 2: make remote maintenance deliberate and auditable

Some systems need remote monitoring and maintenance. The answer is a controlled path, not an open management interface. The NCSC recommends a secured VPN or equivalent protected network. It notes that temporary firewall restrictions to known service-provider addresses may reduce exposure, but IP filtering alone is not a permanent solution. See the NCSC’s remote-access recommendations.

• Require multifactor authentication on the remote-access gateway where supported, and use named accounts rather than shared technician credentials.
• Route maintenance through a managed jump host or access broker instead of allowing a vendor laptop to reach a flat OT network.
• Approve access for a defined maintenance window, restrict it to the required controller and revoke it when work is complete.
• Log VPN, firewall and jump-host activity centrally. Record who changed a setting, why it changed and who approved it.
• Review contractor accounts, emergency access, default credentials and dormant remote-access paths regularly.

Priority 3: verify the physical process independently

A secure network path does not prove that the controller is behaving safely. Establish a known-good baseline for temperature setpoints, operating limits, defrost schedules, alarm thresholds, notification destinations and authorised accounts. Have the refrigeration engineer and site operations owner approve it, and keep a change record for planned maintenance.

• Alert on unexpected setpoint changes, unusual defrost cycles or configuration edits outside an approved service window.
• Watch for new accounts, privilege changes, logins from unfamiliar locations, unexpected restarts and remote-access changes.
• Check that alarms have not been disabled, redirected or assigned to an unattended mailbox or phone number.
• Compare controller telemetry with independent temperature sensors or data loggers, and verify alerts reach staff who can respond.
• Retain firewall, VPN, service-provider and monitoring records outside the controller. Local logs may be incomplete after an incident.

Independent monitoring matters because an attacker who can control a device may also affect the evidence it produces. A separate temperature logger, physical inspection and out-of-band alarm route help operators question readings that look normal on the controller. This is a resilience measure, not a substitute for fixing the access problem.

If you suspect a controller has been compromised

Coordinate the response with the site operations lead and a qualified refrigeration engineer. Disconnecting a controller without understanding the process can create a separate safety or product-quality problem. Preserve evidence while stopping untrusted remote access.

• Restrict network access and disable unnecessary remote sessions. Keep the device away from general IT and the public internet.
• Check actual temperatures, setpoints, defrost schedules, alarm routes and user accounts against the approved baseline.
• Preserve external logs, configuration backups, firewall and VPN records, service tickets and independent temperature history before resetting equipment.
• Ask the vendor for a product-specific compromise assessment, supported recovery procedure and written fix status. Consider replacement if the equipment is unsupported or cannot be trusted.

Do not assume a factory reset alone makes a device safe. CERT-FR warns that resetting an end-of-life controller without removing its underlying vulnerability can lead to another compromise. The new NCSC advisory also relays research describing persistence that may survive a factory reset or firmware update. These are distinct findings, but both support a cautious response: isolate first, preserve evidence and use vendor-guided forensics or replacement where integrity cannot be established. CERT-FR explains why resetting an unsupported, still-exposed device is not enough.

What is known—and what remains uncertain

As of the NCSC advisory dated 13 November 2026, the six AK-SM800A vulnerabilities had no assigned CVE identifiers and no available patches. The NCSC does not say that these six newly disclosed flaws were used in the previously reported attacks; it separately describes ongoing incidents involving internet-exposed refrigeration interfaces. Technical details are being withheld during coordinated disclosure. Check directly with Danfoss or an authorised service provider for later updates rather than assuming that firmware 5.3.2 or a security-mode setting resolves the new findings.

A practical checklist for Indian operators

For supermarkets, cold stores, food manufacturers, hospitals and pharmaceutical logistics teams, assign an owner to close each action:

• Inventory all refrigeration and cold-chain controllers, including supplier-managed and cellular-connected devices.
• Remove public management access and document the approved remote-maintenance route.
• Confirm the exact model and firmware with the vendor; do not treat AK-SM800A firmware 5.3.2 or earlier as cleared by the 13 November advisory.
• Verify setpoints, defrost schedules, alarm delivery and temperature records with operations staff.
• Review end-of-life devices and plan isolation or replacement where security support is unavailable.
• Exercise an incident procedure covering cyber response, refrigeration engineering, product quarantine and continuity.

The key takeaway

The new AK-SM800A findings show why patching cannot be the only control for connected operational technology—especially when a fix is not yet available. Remove direct internet exposure, constrain supplier access, monitor the physical process independently and prepare a safe recovery path. Teams building practical security capability can explore the Academy’s hands-on labs to strengthen the skills needed to protect operating environments.