CVE-2025-41450

Published May 8, 2025

Last updated 6 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-41450 is an improper authentication vulnerability affecting the Danfoss AK-SM8xxA Series, which are system managers used to orchestrate refrigeration and HVAC systems in the food retail sector. Discovered by researchers at Claroty, the flaw is rooted in a hidden "code-of-the-day" authentication mechanism that utilizes a password based on the current date. By abusing this mechanism, an attacker can bypass normal authentication controls on the device. Successfully exploiting this vulnerability allows an attacker to access the device's administrative interface and generate web reports containing sensitive information, such as internal IP addresses, usernames, and store names. This vulnerability, alongside others in the same product line, has been highlighted in the context of cyberattacks targeting supermarket refrigeration systems to disrupt temperature controls. Danfoss has released firmware updates to remediate the issue.

Description: Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
Source: d7ff35af-cf88-454c-bab9-af60602f10f8
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.2
Impact score: 6
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H
Severity: HIGH

Weaknesses

d7ff35af-cf88-454c-bab9-af60602f10f8: CWE-305

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 6

References