Our analysis began by examining the internet exposure of these devices, where we identified thousands of publicly accessible management interfaces. We then reverse engineered the firmware to reconstruct the architecture of the embedded web service, ultimately tracing each vulnerability from the HTTP request handlers down to the underlying implementation.

These findings demonstrate how undocumented functionality, insecure command construction, and dynamically modifiable web server configurations can combine to create powerful attack chains against internet-accessible cyber-physical systems.

In this blog, we will explain:

• How we researched the Danfoss AK-SM 800A platform
• Some details on the Code-of-the-Day vulnerability we uncovered
• How we used CVE-2025-41451 to achieve remote code execution
• The successful coordinated disclosure with Danfoss.

What is the Danfoss AK-SM 800A?

Danfoss is one of the largest manufacturers of refrigeration and HVAC equipment worldwide. Its solutions are deployed throughout supermarkets, cold-storage facilities, warehouses, and commercial buildings.

Among its management platforms is the AK-SM 800A, a centralized system manager responsible for coordinating refrigeration controllers throughout an installation.

The platform aggregates information from numerous field devices while providing operators with a web-based management interface for monitoring and configuring the entire refrigeration environment.

Danfoss AK-SM 800A management panel.

From a single console, administrators can:

• Monitor refrigeration circuits
• Configure temperature thresholds
• Review historical alarms
• Adjust operating schedules
• Configure notification services
• Manage users and permissions
• Perform maintenance activities remotely

The system effectively becomes the operational control center for Danfoss refrigeration infrastructure.

Because technicians frequently administer these systems remotely, the AK-SM 800A includes an embedded web server that exposes a browser-based management interface. This convenience significantly reduces maintenance costs, allowing engineers to troubleshoot problems without traveling to every installation.

Measuring the Danfoss AK-SM 800A Attack Surface

Before diving into the firmware, we wanted to answer a simple but important question: could an attacker actually reach these systems in the first place?

Industrial control systems are often assumed to be safely tucked away on isolated networks. Unfortunately, that assumption doesn't always hold true.

To understand the real-world exposure of the Danfoss AK-SM 800A, we searched publicly available internet-wide scanning platforms, including Shodan and Censys, for signatures associated with its management interface. It didn't take long to find what we were looking for. Numerous controllers were directly accessible from the public Internet.

Many of these exposed systems displayed the distinctive HTTP/S title of the Danfoss StoreView management interface, suggesting that administrators had exposed the web console for remote management.

2765 exposed devices according to Censys AK-SM 800A devices scan.

For an attacker, this significantly lowers the barrier to entry. Instead of first compromising a corporate network or gaining physical access to a supermarket, they can simply scan for exposed controllers, identify devices running vulnerable firmware, and begin interacting directly with the embedded web application.

That discovery also influenced the direction of our research. While the controller supports multiple industrial communication protocols, the Internet-facing web interface represents the most realistic entry point for a remote attacker. As a result, we shifted our attention there first.

Once we started reverse engineering the firmware, it became clear that the web interface was much more than a simple management portal. Behind it was a surprisingly complex architecture, with multiple interacting components that ultimately became the focus of our security analysis.

Instead of a single HTTP server processing requests, the platform implemented multiple layers of reverse proxies, CGI handlers, and application logic spread across several independent processes.

Understanding this architecture became the key to discovering every vulnerability that followed.

Web Service Architecture Breakdown

After extracting the firmware and examining the filesystem, we began identifying the binaries and configuration files responsible for servicing HTTP requests.

The first component we encountered was an externally exposed Nginx instance responsible for listening on the management ports used by the web interface. Rather than directly implementing application logic, this Nginx server acts primarily as a reverse proxy responsible for dispatching requests to other components within the system.

The main nginx.conf configuration file defines that requests with the suffixes .cgi will be routed into a CGI instance running on the system sm_fcgi_app.The CGI executable sm_fcgi_app handling the routed request is responsible for initial handling of the web request according to system configuration sm_fcgi_app.conf.

sm_fcgi_app.conf configuration file

Inspecting the handling of the request inside the sm_fcgi_app executable, we understood that it implements initial processing of the request and then forwards it to the internal Nginx using the method forward_xml_request.

Decompiled snippet of the sm_fcgi_app main function calling forward_xml_request

The internal Nginx instance is configured to listen on the local interface.

Internal Nginx instance server configuration file.

Further down in the configuration, we found that requests targeting URLs with the .cgi suffix are forwarded to a separate CGI service running as part of a task created by the sm_app executable. This task, named Task_Web, implements the core logic of the device's web application. Once requests reach this component, they are fully parsed, processed, and dispatched to the appropriate application handlers.

Uncovering the Code-of-the-Day (CVE-2025-41450)

Authentication code is often one of the most security-sensitive components of an embedded management platform. At this point, we focused on the request-processing logic responsible for user authentication. Specifically, we analyzed requests sent to the xml.cgi endpoint with the action="getauth" parameter.

xml.cgi web service authentication request.

Analyzing the handling of this request led us to the xml_get_data function, which dispatches incoming requests to their corresponding action handlers based on the requested operation. In our case, the request was routed to the handler for the getauth action.

While analyzing this routine, we discovered a potential authentication bypass that allows an attacker to avoid the standard password verification performed against the user credentials stored on the system.

This behavior became apparent after we identified two request attributes (redacted) whose purpose was not immediately clear. When either of these attributes is included in a request, the authentication flow is redirected to a function that contains a code path leading to another function named check_code_of_day.

A closer examination of these functions revealed what appears to be a hidden authentication mechanism, likely intended for vendor support or maintenance. Instead of validating the configured administrator password, the application accepts a specially crafted authentication request containing a generated "code of the day."

Based on our analysis, this alternate authentication path is activated by setting specific request parameters to 1 and supplying a precomputed password. Rather than comparing this value against the configured user credentials, the application validates it against a password generated internally from the device's current date and time.

By reverse engineering the check_code_of_day routine, we were able to fully reconstruct the algorithm responsible for generating this daily authentication code. This demonstrated that anyone capable of reproducing the algorithm could generate valid authentication credentials without knowing the administrator's password. If discovered by a malicious actor, this hidden authentication mechanism could be abused to completely bypass the normal login process and gain administrative access to the device's web management interface.

check_code_of_day password generation and comparison function.

This routine generates a daily authentication password based solely on the device's current date. By reproducing the same algorithm, an attacker can generate a valid authentication code for any given day and use it to bypass the standard login process. Successful authentication through this hidden mechanism results in a fully authenticated administrative session, granting privileged access to the device's web management interface.

Achieving Remote Code Execution (CVE-2025-41451)

Successfully bypassing authentication dramatically expanded the attack surface available for analysis. Instead of being limited to the small number of unauthenticated endpoints, we gained access to the device's full administrative interface and every management function it exposed. Like many embedded management platforms, the AK-SM 800A includes a wide range of configuration pages for network settings, alarm management, user administration, email notifications, logging, and system maintenance.

When reverse engineering embedded web applications, one of the first places we look is functionality that interacts with the underlying operating system. Configuration pages that invoke external utilities are particularly attractive because they often involve constructing shell commands from user-controlled input.

The SMTP Email configuration page quickly stood out. By tracing the request responsible for updating the email settings, we eventually reached the code responsible for constructing the command executed by the operating system.

The value fetched from item number 0x1be1 is formatted into the OS shell command. This is our email authentication password. The field value being formatted into the shell command is not sanitized according to our analysis and could potentially include OS shell directives that yield subsequent commands controlled by a potential attacker.

Setting the Email configuration with command injection payloads.

NGINX Configuration Injection (CVE-2025-41452)

During our analysis, we noticed that the externally exposed Nginx instance includes the configuration file headers.conf as part of its server configuration.

Inclusion of the headers.conf inside our externally exposed Nginx instance server.

Further investigation revealed that the web application exposes functionality for replacing this file and reloading the external Nginx instance at runtime, effectively allowing new configuration directives to be applied without restarting the device. This capability is exposed through the action="load_nginx_headers" endpoint, which accepts the contents of a new headers.conf file via an authenticated file upload.

xml_load_nginx_headers function handling headers.conf configuration file placement.

While testing this functionality, we discovered that an attacker could abuse it to implant arbitrary routing directives into the Internet-facing Nginx configuration. This allows an attacker to modify how requests are handled by the web server and potentially manipulate clients interacting with the device.

During further testing, we also identified an unexpected edge case. Requests directed to a maliciously implanted route triggered an unhandled exception inside the sm_app process responsible for servicing web requests. The resulting crash terminated the web service, allowing an authenticated attacker to repeatedly trigger a denial-of-service condition against the management interface.

Coordinated Disclosure

Claroty Team82 privately reported these vulnerabilities to Danfoss through a coordinated vulnerability disclosure process. Danfoss investigated our findings and released firmware version R4.3.1, which addresses the vulnerabilities described in this research.

Customers using affected AK-SM 800A controllers should upgrade to firmware version R4.3.1 or later as soon as possible. Organizations should also avoid exposing management interfaces directly to the Internet and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls.

We appreciate the collaboration of the Danfoss Product Security Incident Response Team throughout the disclosure and remediation process.