Full Report
Claroty’s Team82 research team reproduced three previously disclosed vulnerabilities in Danfoss AK-SM 800A refrigeration controllers using an artificial... The post Claroty Team82 shows AI can rebuild Danfoss controller exploits in 28 minutes, putting Internet-facing OT at risk appeared first on Industrial Cyber.
Analysis Summary
# Vulnerability: Danfoss AK-SM 800A Authentication Bypass and Command Injection Chain (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452)
*Note: The source article is a news summary of Claroty Team82 research. It does not provide CVSS scores, CWE mappings, patch versions, or detection guidance. Those fields are marked accordingly. Check the vendor advisories and the Claroty disclosure dashboard before acting.*
## CVE Details
- **CVE IDs:**
- CVE-2025-41450 (authentication bypass)
- CVE-2025-41451 (not characterized in the article)
- CVE-2025-41452 (not characterized in the article)
- **CVSS Score:** Not provided in the article. Retrieve from NVD or the Claroty disclosure dashboard.
- **CWE:** Not provided in the article.
## Affected Systems
- **Products:** Danfoss AK-SM 800A refrigeration controllers
- **Versions:** Not specified in the article. Firmware was publicly downloadable from Danfoss's website. The researchers analyzed a 67 MB main application binary.
- **Configurations:** Devices exposed to the internet. Searches using Censys and Shodan found thousands of potentially exposed devices. The article does not describe other specific configuration conditions.
## Vulnerability Description
- Team82 reproduced three previously disclosed vulnerabilities in the AK-SM 800A controller.
- CVE-2025-41450 is an authentication bypass. The AI agent initially failed to analyze it correctly. Researchers redirected the investigation and supplied Ghidra decompilation and cross-reference analysis through a Model Context Protocol (MCP) integration.
- Once the bypass was reproduced, it was chained with command injection to achieve root-level command execution on a lab device. The article does not explicitly name CVE-2025-41452 as the command injection, so confirm the mapping against the advisories.
- The research used public firmware and public vulnerability identifiers. It did not demonstrate autonomous discovery of new vulnerabilities.
## Exploitation
- **Status:** PoC-level exploitation demonstrated in a lab. The researchers built a working exploit chain in about 28 minutes at roughly US$6 in AI usage. The article does not state whether exploit code was published.
- **Complexity:** Not formally rated in the article. The authentication bypass required human-guided analysis. Reproduction was substantially faster and cheaper with AI assistance.
- **Attack Vector:** Network. The concern centers on internet-exposed devices reachable without first compromising an internal network.
## Impact
- **Confidentiality:** Not rated in the article. Root-level access implies a potentially high impact (inferred).
- **Integrity:** Not rated in the article. Root-level command execution implies a potentially high impact (inferred).
- **Availability:** Not rated in the article. Control of a refrigeration controller could affect cold-chain operations (inferred).
## Remediation
### Patches
- None listed in the article. Check the Danfoss security advisories for fixed firmware versions.
### Workarounds
- Remove direct internet exposure of AK-SM 800A controllers. The article's central concern is internet-facing OT devices.
- Place controllers behind segmented networks, VPNs, or other access controls.
- Restrict management and remote access paths, and review any remote access to refrigeration systems.
- Track vendor guidance for interim mitigations, as none are specified in the article.
## Detection
- **Indicators of compromise:** None listed in the article.
- **Detection methods:**
- Inventory and scan for internet-exposed AK-SM 800A devices using Censys or Shodan, the same approach the researchers used. Use this for defensive exposure assessment.
- Monitor for unexpected authentication events, configuration changes, or unusual command execution on controllers.
- Review network logs for inbound connections to controller management interfaces from unexpected sources.
## References
- Claroty Team82 blog post: hxxps://claroty[.]com/team82/research/firmware-to-root-in-30-minutes-how-ai-is-changing-threat-intelligence
- Claroty Team82 disclosure dashboard, CVE-2025-41450: hxxps://claroty[.]com/team82/disclosure-dashboard/cve-2025-41450
- Claroty Team82 disclosure dashboard, CVE-2025-41451: hxxps://claroty[.]com/team82/disclosure-dashboard/cve-2025-41451
- Claroty Team82 disclosure dashboard, CVE-2025-41452: hxxps://claroty[.]com/team82/disclosure-dashboard/cve-2025-41452
- Industrial Cyber article: hxxps://industrialcyber[.]co/ai/claroty-team82-shows-ai-can-rebuild-danfoss-controller-exploits-in-28-minutes-putting-internet-facing-ot-at-risk/ (URL path inferred from the article title; verify before use)
- Danfoss vendor advisories: not linked in the source article. Search Danfoss's security advisory page.