# Claroty Team82: AI coding agent (Claude Sonnet 4.6 via Cursor) reproduces Danfoss AK-SM 800A exploits (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), chaining auth bypass and command injection for root command execution in ~28 minutes

> Claroty Team82 ran an AI coding agent in a researcher-guided lab exercise to reproduce three previously disclosed Danfoss AK-SM 800A refrigeration-controller vulnerabilities and chained the authentication bypass with the command injection to demonstrate root-level command execution in about 28 minutes for roughly $6 of AI usage. It was a reproduction of known, patched flaws, not new discovery, but it shows how cheaply AI can accelerate exploit development against internet-exposed OT; Claroty states the route used in the October 2026 French supermarket refrigeration attacks has not been established.

- **Published:** 2026-10-19T13:45:37Z
- **Last reviewed:** 2026-10-19T13:45:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3888
- **ID:** TL-2026-3888
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-41450, CVE-2025-41451, CVE-2025-41452

## Description

Danfoss AK-SM 800A is a centralized refrigeration management platform used in supermarkets, cold-storage facilities and warehouses. Its embedded web management interface sits behind an externally exposed Nginx reverse proxy that forwards to sm_fcgi_app, then an internal Nginx instance and sm_app (core web application, Task_Web). Authentication flows through xml.cgi with a getauth action routed to handler functions.

Claroty Team82 (researcher Tomer Goldschmidt) previously disclosed three vulnerabilities in this interface, documented in CISA ICSA-25-140-03: CVE-2025-41450 (CWE-287, CVSS v3.1 8.2) is a hidden 'code-of-the-day' authentication path, activated by specific request parameters, that validates against a time-based code derived from the device date/time (check_code_of_day), letting an attacker who reproduces the algorithm obtain an administrative session without knowing the password; fixed in R4.2. CVE-2025-41451 (CWE-77, CVSS v3.1 7.6) is an OS command injection where the unsanitized email/alarm-to-mail SMTP authentication password field is formatted into a shell command, giving post-authentication RCE; fixed in R4.3.1. CVE-2025-41452 (CWE-15, CVSS v3.1 5.4) lets an authenticated user upload arbitrary Nginx configuration directives through the load_nginx_headers endpoint, enabling routing manipulation of the internet-facing Nginx and denial of service via unhandled exceptions/process crashes; fixed in R4.3.1. Claroty's Censys scan found 2,765 exposed AK-SM 800A devices.

In the AI exercise (reported 2026-10-13), Claroty ran Claude Sonnet 4.6 in medium reasoning mode through the Cursor AI coding editor against a Danfoss AK-SM 800A in a laboratory. Inputs were public vulnerability information, firmware downloaded from Danfoss's website and analysis tooling. About 28 minutes elapsed from initial analysis to a working exploit; AI usage was estimated at about $6. The agent reproduced two vulnerabilities initially; researchers redirected the authentication-bypass analysis when it went off track and supplied Ghidra integration for the roughly 67 MB binary, after which the agent chained the authentication bypass with the command injection to demonstrate root-level command execution on the lab device. Claroty stresses this was a researcher-guided reproduction of known flaws, not discovery of new vulnerabilities.

Context: on the night of 2026-10-11 attackers remotely drove cold-storage defrost cycles at French retailers (temperatures reported near 50C); CERT-FR named Danfoss AK-SM and AK-SC and Copeland/Dixell xweb controllers and cited numerous compromises without naming a vulnerability, and Danfoss said most affected units were end-of-life (notably AK-SM800 and AK-SC355) with some AK-SM800A units on outdated firmware. Reported scale varies by source (roughly 250-350, over 400, up to about 700 stores). No source ties the incident to these CVEs or to AI-assisted tooling; initial access is unconfirmed, no actor has been attributed, and no network IOCs were published. Third-party exposure counts (4,980 hosts, about 58% in France, per cybersecuritynews) reflect Shodan exposure, not confirmed compromise. A third-party public PoC ('fromagegate') reconstructing a suspected chain was reported on social media; its content was not independently verified. Severity reflects the highest component CVSS (8.2) and the chained pre-auth-to-root outcome.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1596.005 Scan Databases
- T1587.004 Exploits
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell

## Sources

- [Claroty Team82 - Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers)
- [CISA ICS Advisory ICSA-25-140-03 - Danfoss AK-SM 8xxA Series (Update A)](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03)
- [Claroty says Claude reproduced Danfoss flaws in about 28 minutes (NeoTeo)](https://www.neoteo.com/en/claroty-says-claude-reproduced-danfoss-flaws-in-about-28-minutes)
- [Industrial Cyber - Claroty Team82 shows AI can rebuild Danfoss controller exploits in 28 minutes](https://industrialcyber.co/ai/claroty-team82-shows-ai-can-rebuild-danfoss-controller-exploits-in-28-minutes-putting-internet-facing-ot-at-risk/)
- [Cybernews - Hackers could disable your local supermarket fridge for just $6](https://cybernews.com/ai-news/hackers-disable-supermarket-fridge-claude-ai-costs-6-dollars/)
- [Danfoss Refrigeration Hack Update - 4,980 Hosts Found Exposed to Internet](https://cybersecuritynews.com/danfoss-refrigeration-hack-exposed-hosts/)
- [French supermarkets refrigeration attack: Danfoss says most units end-of-life, no link to Claroty flaws](https://www.pk-sharma.com/briefing/french-supermarkets-refrigeration-attack-danfoss-says-most-units-end-of-life-no-link-to-claroty-flaws)
- [CISO Daily Briefing 2026-10-13 (Cloud Security Alliance Labs)](https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20261013/)
- [Claroty Team82 Disclosure Dashboard - CVE-2025-41451](https://claroty.com/team82/disclosure-dashboard/cve-2025-41451)
- [Claroty Team82 Disclosure Dashboard - CVE-2025-41450](https://blog.claroty.com/team82/disclosure-dashboard/cve-2025-41450)
- [Refindustry - Danfoss, Copeland and Trane address controller security vulnerabilities](https://refindustry.com/news/danfoss-copeland-and-trane-address-controller-security-vulnerabilities/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3888