Don't bother patching: multiple remote code execution vulnerabilities in Danfoss AK-SM800A

A security review of Danfoss AK-SM800A refrigeration controllers running firmware up to version 5.3.2 uncovered six pre-authentication remote code execution zero-day vulnerabilities, all stack-based buffer overflows, found within an hour of manual investigation. Censys data shows hundreds of Danfoss systems still exposed online, alongside over 1,000 Copeland and Dixell fridge controllers and hundreds of Eliwell units. The new flaws can enable full device takeover, persistent access that may survive a reset, and persistent denial of service that renders a controller inoperable. The researchers argue that patching alone is insufficient and urge defenders to restrict exposure via VPNs, private APNs or tight IP whitelisting, noting that remote maintenance is often retained to avoid SLA or insurance breaches. CVE identifiers are pending coordinated disclosure with Danfoss, and technical details are being withheld until that process concludes.