CVE-2025-41451
EPSS 3% (87th percentile).
OT / ICS · 6h ago
France’s CERT-FR reported that attackers compromised refrigeration controls at supermarkets on October 11–12, disrupting operations across multiple retailers. The agency identified Danfoss AK-SM and AK-SC controllers, plus Copeland and Dixell XWEB systems, among those involved.
Attackers remotely changed refrigeration settings and triggered defrost cycles; some units reached 50°C, spoiling food. They used normal control functions to make equipment warm instead of preserve food, without necessarily destroying the controllers. Separately, Claroty Team82 identified vulnerabilities in Danfoss and Copeland products, but reporting does not establish that attackers used those flaws.
Where retailers depend on remotely managed refrigeration, a controller compromise can become a site-level inventory and trading loss. The reported attacks also leave the intrusion route unresolved, so the listed vulnerabilities alone do not explain which systems or sites were exposed.
EPSS 3% (87th percentile).
CVSS 8.2 HIGH: improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior… EPSS 0.8% (55th percentile).
EPSS 0.7% (53rd percentile), up from 0.3%.
CVSS 8.6 HIGH: a vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the… EPSS 0.5% (42nd percentile).
1 source covering this story
FortiGuard Labs Threat Signals
Threat Signal Report | FortiGuard Labs
What is the Attack?On October 11–12, 2026, attackers compromised refrigeration control systems at supermarkets across France, remotely manipulating...
Part of the PlainSec briefing for 2026-10-24