A nightmare scenario for supermarkets: Hidden daily passwords and command injection flaws leave thousands of Danfoss…
- Thousands of Danfoss refrigeration controllers were discoverable through public internet scanning
- A hidden daily code could bypass normal administrator password verification
- An email configuration flaw could enable operating system command execution
Thousands of Danfoss refrigeration management systems may face remote attacks after researchers uncovered authentication weaknesses and dangerous software flaws.
Security researchers at Claroty’s Team82 used Censys, a cybersecurity platform, to identify 2,765 publicly accessible systems.
Their investigation identified three vulnerabilities affecting the AK-SM 800A controller, which manages refrigeration equipment in supermarkets, warehouses and cold storage facilities.
The AK-SM 800A provides centralized monitoring and configuration of refrigeration equipment, including temperature settings, operating schedules, alarms, and notification services.
Its browser accessible management interface allows technicians to maintain installations remotely, but internet exposure can also give attackers direct access to vulnerable systems.
Team82 discovered an undocumented authentication mechanism that could allow attackers to circumvent the administrator password through a daily generated access...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
