CVE-2025-41451/41452: Danfoss, Copeland, Dixell Controllers — Supermarket Refrigeration Sabotage (June 2025)

CVE-2025-41451/41452 — Danfoss, Copeland, Dixell Refrigeration Controllers

CVE-2025-41451 and CVE-2025-41452 are high-severity vulnerabilities in Danfoss, Copeland, and Dixell programmable refrigeration controllers. These flaws allow remote attackers to manipulate device settings, resulting in overheating and, in confirmed cases, physical fires. Both CVEs are actively exploited in the wild, with no authentication required for initial access.

Attack Vector

Attackers scan for exposed refrigeration controllers with open management interfaces on public IPs. Exploitation involves sending crafted commands to override temperature and safety parameters, disabling alarms and causing compressors to overheat. No lateral movement is required; direct access to the controller's interface is sufficient. The attack does not require valid credentials if default or no authentication is enabled. There are no known IOCs published, but abnormal temperature setpoint changes and unauthorized configuration events are reliable indicators.

Who Is at Risk

All organizations deploying Danfoss, Copeland, or Dixell refrigeration controllers with internet-exposed management interfaces are at risk. Hundreds of French supermarkets—including Carrefour, Monoprix, Cooperative U, and Intermarche—have suffered property damage and operational outages. Thousands of similar devices remain exposed globally, especially in retail, food logistics, and cold storage sectors.

Patch & Mitigate

• Patch: Apply vendor firmware updates for Danfoss, Copeland, and Dixell controllers immediately. Check vendor advisories for model-specific hotfixes. Deadline: immediate, as active exploitation is ongoing.
• Workaround: Remove all controller management interfaces from public internet access. Enforce strong authentication and network segmentation.
• Detect: Monitor for sudden or unauthorized changes to refrigeration setpoints, alarm disablement, or unexpected remote connections in device logs. Review network traffic for unusual access to controller IPs.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed device interfaces to gain direct access without authentication.
• TA0005 — Defense Evasion: Malicious commands disable alarms and safety controls to avoid detection during sabotage.

Source: https://www.cybersecuritydive.com/news/thousands-refrigerator-devices-exposed-french-cyberattack/833117/