Germany's Federal Office for Information Security warned of flaws in Danfoss refrigeration controllers that could let attackers disable equipment, raising operational risks for businesses dependent on industrial cooling.
The warning applies to AK-SM 800A controllers with firmware through version 5.3.2, the BSI said. It advised operators to keep those affected units inaccessible from the public internet and use a virtual private network (VPN) when remote maintenance is needed. A successful intrusion could let attackers install malware and disable a controller, potentially interrupting operations for an extended period. The BSI said it had no indication that the newly identified flaws were being exploited.
In its Nov. 13 notice, the BSI described software package 5.4.0, dated November 2026, as unaffected. Midnight Blue’s research covers firmware only through version 5.3.2 and does not determine whether 5.4.0 fixes the issues. Handelsblatt separately reported that the BSI could not rule out an effect on version 5.4.0, an account that conflicts with the agency’s Nov. 13 notice.
Dutch cybersecurity consultancy Midnight Blue said researcher Carlo Meijer identified six weaknesses that could let a remote attacker run code without logging in. The consultancy said vulnerability identifiers were pending and disclosure discussions with Danfoss were continuing. It also said some operators need remote access because maintenance teams are small or service-level agreements or insurance requirements call for it.
The alert comes amid separate incidents involving commercial refrigeration systems in Europe. The European Union Agency for Cybersecurity (ENISA) said similar equipment had been affected in several member states since Oct. 11, with another wave Nov. 1-2. The BSI did not connect those incidents to the newly identified flaws. Reuters reported that attacks on supermarket refrigeration systems had led some stores to discard food; it also reported that the BSI said Danfoss had not supplied sufficient updates to counter those attacks.
EconoTimes previously reported refrigeration disruptions at European grocers.
