Refrigeration controller flaws threaten cold chains

Claroty has identified security vulnerabilities in the Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controller platforms. The flaws affect systems used in supermarkets, warehouses, cold-storage sites, and healthcare settings.

The research focused on supervisory controllers that manage refrigeration equipment across commercial sites and provide web-based tools for monitoring and configuration. Weaknesses in these central management systems could let attackers interfere with cooling operations and spoil temperature-sensitive goods without immediate detection.

Claroty identified three vulnerabilities in the Danfoss AK-SM 800A platform. One involved a hidden authentication mechanism described as a "code-of-the-day", which could be abused to bypass standard login controls and lead to remote code execution.

According to the findings, Danfoss has released firmware version R4.3.1 to address the issues. Organisations using affected controllers were urged to upgrade to that version or a later release and to keep management interfaces off the public internet.

The Copeland XWEB Pro platform was found to contain 23 vulnerabilities, including 21 rated high severity. The flaws could allow an unauthenticated attacker to bypass the platform's security controls and ultimately gain root-level remote code execution.

These systems are widely used in commercial refrigeration, air conditioning, and food retail environments. They also manage distributed field devices, including compressors, evaporators, and environmental sensors, while maintaining temperature records used for compliance purposes.

Operational risk

The findings highlight the exposure created when operational technology relies on networked management systems with weak access controls or delayed patching. In refrigerated supply chains, the direct consequence of a cyber intrusion may be not only data loss but also a physical temperature change that damages stock.

That risk is especially acute in sectors that depend on tightly controlled storage conditions. Large food distribution centres hold substantial volumes of perishable goods, supermarkets operate broad networks of refrigerated cabinets, and healthcare facilities store medicines and other supplies that can degrade if temperature thresholds are breached.

The vulnerabilities show how quickly software flaws in a supervisory controller can turn into physical disruption. Claroty also pointed to predictable credentials, internet-exposed management interfaces, and slow firmware adoption as recurring problems in the sector.

Patches issued

Both manufacturers have issued updates in response to the disclosures. Copeland has released firmware version 1.13 for affected XWEB Pro devices, while Danfoss has made R4.3.1 available for AK-SM 800A users.

The disclosure process followed private reporting to the vendors before public release of the findings. That approach is standard in industrial cybersecurity, where researchers often give manufacturers time to investigate and prepare patches before technical details become widely known.

For operators, patching alone may not address every risk if systems remain exposed through poorly segmented networks. Security specialists generally recommend restricting administrative access to trusted management networks or routing it through virtual private networks rather than allowing direct internet access to controller interfaces.

Cold-chain concern

The issue has broader relevance in Australia because food logistics, retail refrigeration, and some healthcare storage functions depend on continuous climate control across distributed facilities. A compromise at the controller level could affect not just one appliance but a wider group of connected refrigeration assets managed from a single platform.

Supervisory controllers sit at the centre of these environments because they aggregate information from multiple field devices and allow central configuration of settings and alarms. That makes them valuable operational tools, but it also means a successful attack can provide access to equipment that directly influences temperature, defrost cycles, and other essential processes.

Industrial cybersecurity researchers have increasingly focused on these systems as more facilities connect operational technology to wider corporate networks for remote management and reporting. In such setups, a weakness in an embedded web interface or authentication routine can become an entry point into equipment that was once isolated.

The findings add commercial refrigeration to a longer list of industrial environments where cyber vulnerabilities can create immediate physical effects. In this case, the most obvious outcomes include spoiled food and compromised temperature-sensitive medical supplies.

Claroty said improving resilience in the refrigeration sector requires timely patching, network segmentation, limited internet exposure, and stronger protection for the supervisory controllers at the centre of these environments.