Given the well-publicised recent hack of Danfoss refrigeration in France, I wondered whether there were any of the exposed devices in the UK. Given I’m a bit of an amateur with python and the like, I favoured going to the likes of ZoomEye to help me out. Here’s a little bit of a walk through
Before you get started, head over to ZoomEye and get yourself registered for a free account. They offer plenty of paid for options, but likewise you can utilise something a little more heavy duty such as Shodan or Censys.
Scanning internet IP addresses (such as port scanning or vulnerability probing) without explicit authorization can violate Section 1 of the Computer Misuse Act 1990 (CMA) in the UK.
Querying these platforms does not involve unauthorized access or modification of a target system. Instead, you are accessing public repositories of data that have already been gathered by third parties.
Anyway, enough of the warnings, lets focus on what information we’re after: specifically, the Danfoss AK-SM 800 and AK-SM 8xxA series system managers that handle environmental control, supermarket cold storage, and HVAC.
When these get misconfigured and left wide open to the public IPv4 space—often tied into vulnerabilities like the recent CVE-2025-41450 auth bypass—they give anyone on the internet an unauthenticated look into internal system layouts and facility reporting logs.
Instead of dealing with broken API SDK wrappers or paying for heavy commercial tools like the ones I’ve mentioned above, you can use ZoomEye’s free web interface to find them. Here is how to build a quick, clean search query to audit exposure.
1. Crafting the Dork
For those not in the know (and this was me just a few months ago) a Dork is a precise search query using specialized operators to find specific software, files, or exposed devices hidden in search engines.
So once you’ve registered for ZoomEye, you should get an interface similar to this once logged in
ZoomEye indexes HTTP titles, device signatures, and banners. If you just search for "Danfoss", you are going to drown in noise—everything from random variable frequency drives to corporate office IT gear.
To isolate the management portals, you want to target the specific web application signatures or default page titles. Head over to the ZoomEye web dashboard and run a dork targeting the StoreView or AK-SM framework:
app="Danfoss AK-SM" +country="GB"Or, if you are searching by page title signatures returned by the embedded web server:
title="StoreView" +country="GB"2. What You’re Looking For
When the search results populate, pay attention to a few markers:
- Page Titles: Look for indicators like
"StoreView Browser","StoreView Web", or"AK-SM 800 System Manager". - The Login Gate: Most default setups land you right on a standard supervisory login prompt. Out of the box, these frequently ship with baseline credentials like
Supervisor/12345if the on-site integrators didn’t change them during commissioning. - Firmware Footprints: Older firmware iterations (specifically pre-4.2) are where those reporting and information disclosure bugs live.
What I’ve seen (at the time of posting on 14/10/26) is essentially 53 matches. Whether all of those are vulnerable to CVE-2025-41450 – is kind of irrelevant, because they’re exposed to the Internet, which is a no-no for anything OT. But you can do your own investigation nonetheless.
3. Fixing the Exposure
As I’m sure you know from reading my blogs or content, I like to ensure I pass some of our learnings and best practice from my exposure to these type of things in my day-to-day job. That’s what this section is all about.
If you manage these systems or encounter them during an audit, remediation comes down to basic asset hygiene:
- Pull them off the public internet: Never expose operational technology (OT) or HVAC supervisory panels directly to the public-facing internet. Put them behind a secure VPN or Zero Trust access layer.
- Change defaults: If the unit is still running factory default credentials like
Supervisor/12345, lock them down immediately. - Patch firmware: Ensure the AK-SM controllers are updated past version 4.2 to close out authentication bypass paths.
I hope this brief blog is useful for those just curious folks, not just for this particular event, but for others in the future. These open source tools are excellent to utilise sparingly when you’ve got an itch you need to scratch!