Threat reportVulnerabilityTL-2026-3888
Claroty Team82: AI coding agent (Claude Sonnet 4.6 via Cursor) reproduces Danfoss AK-SM 800A exploits (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), chaining auth bypass and command injection for root command execution in ~28 minutes
Claroty Team82 (TL-2026-3888), also tracked as Freeze the Controller, Defrost the Food, is a high-severity software vulnerability scored CVSS 8.2, first published 2026-10-19. It has no confirmed attribution, affects Danfoss AK-SM 8xxA Series (AK-SM 800A), references 3 CVEs (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), maps to 6 MITRE ATT&CK techniques (T1059.004, T1190, T1587.004), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.2/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3888
- Threat ID
- TL-2026-3888
- Also known as
- Freeze the Controller, Defrost the Food, Danfoss AK-SM code-of-the-day bypass
- Severity
- HIGH
- CVSS
- 8.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- retail, food-and-beverage, cold-chain, logistics, industrial-control-systems
- Target regions
- Europe, france, south africa, North America
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Claroty Team82
Malware and tooling: Censys, Claude Sonnet 4.6, Cursor, Ghidra, fromagegate
How Claroty Team82 works
Claroty Team82 ran an AI coding agent in a researcher-guided lab exercise to reproduce three previously disclosed Danfoss AK-SM 800A refrigeration-controller vulnerabilities and chained the authentication bypass with the command injection to demonstrate root-level command execution in about 28 minutes for roughly $6 of AI usage. It was a reproduction of known, patched flaws, not new discovery, but it shows how cheaply AI can accelerate exploit development against internet-exposed OT; Claroty states the route used in the October 2026 French supermarket refrigeration attacks has not been established.
Danfoss AK-SM 800A is a centralized refrigeration management platform used in supermarkets, cold-storage facilities and warehouses. Its embedded web management interface sits behind an externally exposed Nginx reverse proxy that forwards to sm_fcgi_app, then an internal Nginx instance and sm_app (core web application, Task_Web). Authentication flows through xml.cgi with a getauth action routed to handler functions.
Claroty Team82 (researcher Tomer Goldschmidt) previously disclosed three vulnerabilities in this interface, documented in CISA ICSA-25-140-03: CVE-2025-41450 (CWE-287, CVSS v3.1 8.2) is a hidden 'code-of-the-day' authentication path, activated by specific request parameters, that validates against a time-based code derived from the device date/time (check_code_of_day), letting an attacker who reproduces the algorithm obtain an administrative session without knowing the password; fixed in R4.2. CVE-2025-41451 (CWE-77, CVSS v3.1 7.6) is an OS command injection where the unsanitized email/alarm-to-mail SMTP authentication password field is formatted into a shell command, giving post-authentication RCE; fixed in R4.3.1. CVE-2025-41452 (CWE-15, CVSS v3.1 5.4) lets an authenticated user upload arbitrary Nginx configuration directives through the load_nginx_headers endpoint, enabling routing manipulation of the internet-facing Nginx and denial of service via unhandled exceptions/process crashes; fixed in R4.3.1. Claroty's Censys scan found 2,765 exposed AK-SM 800A devices.
In the AI exercise (reported 2026-10-13), Claroty ran Claude Sonnet 4.6 in medium reasoning mode through the Cursor AI coding editor against a Danfoss AK-SM 800A in a laboratory. Inputs were public vulnerability information, firmware downloaded from Danfoss's website and analysis tooling. About 28 minutes elapsed from initial analysis to a working exploit; AI usage was estimated at about $6. The agent reproduced two vulnerabilities initially; researchers redirected the authentication-bypass analysis when it went off track and supplied Ghidra integration for the roughly 67 MB binary, after which the agent chained the authentication bypass with the command injection to demonstrate root-level command execution on the lab device. Claroty stresses this was a researcher-guided reproduction of known flaws, not discovery of new vulnerabilities.
Context: on the night of 2026-10-11 attackers remotely drove cold-storage defrost cycles at French retailers (temperatures reported near 50C); CERT-FR named Danfoss AK-SM and AK-SC and Copeland/Dixell xweb controllers and cited numerous compromises without naming a vulnerability, and Danfoss said most affected units were end-of-life (notably AK-SM800 and AK-SC355) with some AK-SM800A units on outdated firmware. Reported scale varies by source (roughly 250-350, over 400, up to about 700 stores). No source ties the incident to these CVEs or to AI-assisted tooling; initial access is unconfirmed, no actor has been attributed, and no network IOCs were published. Third-party exposure counts (4,980 hosts, about 58% in France, per cybersecuritynews) reflect Shodan exposure, not confirmed compromise. A third-party public PoC ('fromagegate') reconstructing a suspected chain was reported on social media; its content was not independently verified. Severity reflects the highest component CVSS (8.2) and the chained pre-auth-to-root outcome.
MITRE ATT&CK techniques used in TL-2026-3888
Execution
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
T1587.004 Exploits; T1588.005 Exploits
Reconnaissance
Affected products and versions in Claroty Team82
- Danfoss — AK-SM 8xxA Series (AK-SM 800A)
Vulnerable versions: CVE-2025-41450: versions prior to R4.2; CVE-2025-41451 and CVE-2025-41452: versions prior to 4.3.1
Fixed in: R4.2 (CVE-2025-41450); R4.3.1 or later (all three CVEs)
Remediation for Claroty Team82
Patches
- Danfoss AK-SM 8xxA firmware R4.2 (CVE-2025-41450)
- Danfoss AK-SM 8xxA firmware R4.3.1 (CVE-2025-41451, CVE-2025-41452)
Immediate actions
- Upgrade Danfoss AK-SM 8xxA firmware to R4.3.1 or later (R4.2 fixes only CVE-2025-41450)
- Remove or filter internet exposure of AK-SM/AK-SC and xweb controller management interfaces
- Review controllers for unexpected admin sessions, email/alarm-to-mail settings changes and uploaded Nginx header configuration
- Treat end-of-life units (e.g. AK-SM800, AK-SC355) as compromised-if-exposed; a factory reset alone is reportedly not sufficient per CERT-FR
Workarounds
- Firewall/ACL the web management interface so it is not reachable from the internet
- Require VPN for remote access by maintenance firms
- Monitor web requests to xml.cgi getauth, email configuration and load_nginx_headers endpoints
Longer-term hardening
- Restrict administrative access to trusted management networks or VPNs
- Implement network segmentation between OT and business networks
- Replace end-of-life controllers that no longer receive security updates
- Assume AI-assisted exploit development shortens the patch-to-exploit window for internet-facing OT and prioritise patching accordingly
CVEs associated with Claroty Team82
Weaknesses (CWE) in Claroty Team82
Timeline of Claroty Team82
- CISA publishes ICSA-25-140-03 for Danfoss AK-SM 8xxA covering CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, crediting Tomer Goldschmidt of Claroty Team82
- CISA releases Update A to ICSA-25-140-03; Danfoss fixes are R4.2 (CVE-2025-41450) and R4.3.1 (CVE-2025-41451/41452)
- Claroty Team82 publishes 'Freeze the Controller, Defrost the Food' detailing the three AK-SM 800A flaws and 2,765 Censys-visible exposed devices
- Overnight, attackers remotely trigger defrost cycles on refrigeration controllers at French supermarkets, with reported temperatures near 50C; initial access vector not confirmed
- CERT-FR alert names Danfoss AK-SM/AK-SC and Copeland/Dixell xweb controllers and cites numerous compromises without identifying a vulnerability; updated 2026-10-13
- cybersecuritynews reports 4,980 internet-facing Danfoss-related hosts (about 58% in France) based on Shodan exposure, not confirmed compromise
- Claroty reports Claude Sonnet 4.6 via Cursor reproduced the Danfoss flaws in ~28 minutes (~$6) and chained auth bypass with command injection for root command execution on a lab device; route used in French attacks stated as not established
- Briefing update: Danfoss states most affected units are end-of-life (notably AK-SM800 and AK-SC355) and no link to the Claroty flaws is established
Sources cited for Claroty Team82
- Claroty Team82 - Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
- CISA ICS Advisory ICSA-25-140-03 - Danfoss AK-SM 8xxA Series (Update A)
- Claroty says Claude reproduced Danfoss flaws in about 28 minutes (NeoTeo)
- Industrial Cyber - Claroty Team82 shows AI can rebuild Danfoss controller exploits in 28 minutes
- Cybernews - Hackers could disable your local supermarket fridge for just $6
- Danfoss Refrigeration Hack Update - 4,980 Hosts Found Exposed to Internet
- French supermarkets refrigeration attack: Danfoss says most units end-of-life, no link to Claroty flaws
- CISO Daily Briefing 2026-10-13 (Cloud Security Alliance Labs)
- Claroty Team82 Disclosure Dashboard - CVE-2025-41451
- Claroty Team82 Disclosure Dashboard - CVE-2025-41450
- Refindustry - Danfoss, Copeland and Trane address controller security vulnerabilities
Detection coverage for TL-2026-3888
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3888 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.