CVE-2025-41451

Published on Aug 22, 2025

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.

Weakness type (CWE)CWE-77

Vulnerabilities

Attackers Turn Grocery Refrigeration Systems Into Heaters Across More Than 400 Stores

Attackers remotely altered refrigeration controllers in 400+ European stores, raising temperatures and spoiling stock via third-party access.

Oct 15, 202610:14 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2025-41451

Related articles

Attackers Turn Grocery Refrigeration Systems Into Heaters Across More Than 400 Stores

Audience measurement