Belgium warns of new Danfoss controller vulnerabilities
12th November 2026
EUROPE: Belgium’s national cyber security authority has advised removing direct public internet exposure of Danfoss’ AK-SM800A refrigeration controllers after six new vulnerabilities were identified.
The Centre for Cybersecurity Belgium (CCB) warns of six zero-day vulnerabilities allowing pre-authentication remote code execution in the controllers, affecting firmware versions up to and including last month’s update 5.3.2.
Within the last few days, Danfoss has released version 5.4.0 for immediate download. Danfoss requires users to review and acknowledge a readme page before downloading to ensure awareness of cybersecurity enhancements introduced in this release.
The advice from the CCB is based on new research published by Amsterdam-based security consultancy Midnight Blue. It reveals that an attacker could exploit the vulnerabilities without logging in or possessing valid credentials, potentially gaining full control of the affected device.
The warning from CCB advises removing direct public internet exposure as an immediate priority. It says that updating firmware, changing default passwords, and enabling strict session control are insufficient on their own to secure internet-exposed controllers.
The research also identifies a vulnerability in the session control mechanism itself, meaning that strict mode does not eliminate the risk.
The researchers further warn that attackers could potentially establish persistence that survives a factory reset or firmware update, or render controllers inoperable.
Midnight Blue accepts remote connectivity of some sort is often a must-have due to maintenance personnel constraints and SLA or insurance requirements, but insists that applying patches for known vulnerabilities and enabling strict level session control is insufficient.
Asset owners, it says, need to remove internet exposure as soon as possible (eg though use of a VPN, private APN, or highly restrictive IP whitelisting ACLs). It recommends against allocating scarce security resources to patching efforts and instead focus on reducing exposure.
Midnight Blue told the Cooling Post that it is currently looking into the latest Danfoss update and hopes to be able to say something more about its effectiveness tomorrow. However, a spokesperson warned: “Generally speaking, we consider the security quality of the codebase so worrying that we would strongly advise against piecemeal patching here, because there’s bound to be more simple but impactful vulnerabilities of this kind in other parts of the code that haven’t been looked at yet. Hence our recommendation to prioritise reducing exposure though putting these devices behind a VPN, use a private APN, or enable very strict IP whitelists in firewalls.”
Related stories:
Danfoss moves to mitigate cyberattack – 12 October 2026
FRANCE: Danfoss has said it is in close contact with supermarket customers in France affected by a cyberattack on Sunday night on its refrigeration controllers. Read more…
Security firm warns on refrigeration asset security – 13 October 2026
USA: Following Sunday night’s cyberattack on French supermarkets, security company Claroty has warned food retailers that they should not assume that their refrigeration controllers are isolated and secure. Read more…
French supermarkets hit by massive cyberattack – 12 October 2026
FRANCE: Cyberattackers are reported to have taken control of the refrigeration systems in hundreds of supermarkets in France, changing temperature settings and defrosting produce. Read more…
Keeping systems safe from cyber attacks – 12 August 2026
USA: Recent incidents involving cyber attacks on HVACR control systems have underlined their potential vulnerability and the need for vigilance. Read more…
