Midnight Blue reports six unauthenticated code-execution flaws in Danfoss controllers

Midnight Blue says it found six previously unknown vulnerabilities allowing code execution without authentication in Danfoss AK-SM800A refrigeration controllers, including firmware version 5.3.2. The researchers are coordinating disclosure with Danfoss and withholding affected endpoint details. The findings include memory corruption in the component enforcing session controls, which Midnight Blue says undermines protection even when the strict security setting is enabled. Its demonstrated exploit targeted version 3.3.0; it says the bugs also exist in 5.3.2. The researchers recommend restricting network exposure through VPNs, private APNs or highly restrictive IP allowlists rather than relying on patches and strict session controls alone.