Refrigeration controllers: remove internet exposure before a reset
CERT-FR confirms compromises of Danfoss and XWEB controllers. A reset is not enough while access remains exposed, especially on equipment with no security fix.
Going deeper
Generated image · SecuFocus
At a glance
Key points
If you run a shop or a remotely managed refrigeration installation, have its contractor and network administrator check the controller’s internet exposure. CERT-FR’s 12 October alert, revised on 16 October, confirms compromises of Danfoss AK-SM and AK-SC, and Copeland and Dixell XWEB systems. Remove public access before restoring protected access: a reset alone leaves the exposure in place.
Check the controller, not just the shop network
CERT-FR says it knows of numerous compromises in these controller families and advises against exposing management interfaces directly to the internet. Its alert does not provide a complete model and version matrix that would establish whether an entire brand is vulnerable or fixed.
Record the exact controller, firmware and route the contractor uses for remote maintenance. Equipment separate from the checkout network can still have a public interface. Work with the people responsible for the installation; do not probe other shops’ addresses.
BSI also confirms incidents in Germany
In its 3 November revision, BSI says it is aware of unauthorized manipulation of internet-accessible refrigeration controllers at individual German supermarkets and in numerous other European countries. Food had to be discarded in some cases. The authority says Germany’s security of supply is not at risk.
BSI calls for removing direct internet access, protecting necessary access with VPNs and multifactor authentication, and keeping equipment updated. This addition identifies neither one brand nor a universal CVE and does not replace assessment of your installation.
Keep the installation operational while closing public access
The alert calls for removing internet exposure from affected units and units with a public IP address. It also says to check contractual insurance conditions before cutting data reporting to the refrigeration contractor. Coordinate the change rather than blindly interrupting temperature monitoring.
For restored remote access, CERT-FR recommends a secure VPN or a protected network. Restricting access to the contractor’s source IP addresses is an emergency measure, not a permanent design. Check the entire configuration afterwards, particularly defrost schedules.
A reset does not patch end-of-life equipment
The bulletin separates compromised devices from others. For compromised equipment it describes a Danfoss restart or a restoration, followed by reconfiguration before service resumes. Let the installation’s maintainer choose the procedure after preserving useful incident evidence. A factory reset is not a harmless diagnostic test.
In either case, follow the manufacturer’s firmware, password and security-setting guidance. Strict mode is an example for Danfoss, not a universal setting shared by every controller.
CERT-FR warns that end-of-life equipment without a security fix can be compromised again if it remains exposed after a reset. Removing persistence does not remove the vulnerability or the need to redesign access.
What this alert establishes
This reading uses the French October alert, checked again on 2 November. It does not attribute the shop counts or countries in newer press reports to that alert. CERT-FR says attack campaigns are probably still ongoing; this does not establish an identical attack on every installation.
SecuFocus inspected no controller and provides no food-storage assessment. If operation or temperatures have changed, involve the appropriate technical and food-safety personnel, separately from restoring network access.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.