Belgium Urges Removing Internet Exposure of Danfoss Controllers After Vulnerabilities Found

Belgium's national cybersecurity authority has advised organizations to remove direct public internet exposure of Danfoss' AK-SM800A refrigeration controllers. This follows the identification of six new vulnerabilities that allow pre-authentication remote code execution.

The vulnerabilities affect firmware versions up to and including 5.3.2. Despite Danfoss releasing version 5.4.0 for download, this update does not address the vulnerabilities discovered by Midnight Blue researcher Carlo Meijer.

Confirmed attacks on these internet-exposed controllers began in France on October 11, with a second wave occurring on November 2. These attacks resulted in significant damage, including spoiled food.

CISA and the FBI have issued warnings about attacks on industrial refrigeration systems, suggesting the issue is not confined to Europe. Midnight Blue recommends removing internet exposure and using a VPN or private APN.

The vulnerabilities include flaws in the session control mechanism and the lack of secure boot features, allowing attackers to plant persistent implants.