I’m not sure what I expected, but this article is quite depressing.
Many industrial devices include a service access so the vendor’s technician can get in without the customer’s password. A classic —and dangerous— way to implement it is the code of the day: a code that changes every day according to a formula that, in theory, only the vendor knows.
The problem shows up when that “secret formula” is the only thing protecting access (security by obscurity) and it can also be recovered from the firmware itself. That is exactly what happens here: sm_app ships unobfuscated, with function and variable names in plain sight. The one that validates the code is called, literally, check_code_of_day.
The article is from October 14th and notes:
Whether the attack went through CVE-2025-41450 is, for now, just a hypothesis: the vector has not been officially established and the investigation is still open. Several reports throughout this year had already warned that something like this could happen, and during 2025 several vulnerabilities were disclosed in Danfoss equipment that ended in a vendor fix. The flaw we look at here is public and patched (at least since R4.3.1).
That makes the most recent attacks all the more alarming, should they have been achieved via the same method.
These vulnerabilities were present the entire time, and the cost of exploiting them is dropping toward zero. You no longer need to stick out, to be targeted. There doesn’t have to be a specific reason.
Don’t put infrastructure on the network without a damn good reason and an off switch.
My pessimistic self wonders if the owners/users of these freezers even know they are in the internet 😭
