Darktrace Finds Internet-Exposed Industrial Control Interfaces
Summary
Darktrace researchers found hundreds of internet-exposed IoT and OT devices, including refrigeration controllers and PLC interfaces, some lacking authentication or using weak credentials. Exposed interfaces may reveal system details or allow changes that disrupt systems
Key points
- French supermarkets were reportedly affected by an attack on refrigeration systems, but how attackers gained access has not been confirmed.
- Darktrace researchers identified hundreds of publicly exposed IoT and OT devices, including devices with no authentication or weak or default credentials.
- Exposed Copeland XWEB interfaces used to manage Dixell equipment can provide remote control of connected systems, including refrigeration and air conditioning.
- WAGO management interfaces may allow users to change network or Modbus settings, load firmware or configurations, or reset passwords, potentially disrupting operations.
- Allen-Bradley CompactLogix web interfaces can expose model, firmware, network and connection details that could aid reconnaissance; the article attributes the risk to deployment and configuration, not a vendor flaw.
- The article cites CVE-2025-41450, a vulnerability in Danfoss AK-SM 8xxA Series controllers that researchers said could allow administrative access through a time-based authentication code.
- Darktrace recommends asset visibility, continuous monitoring, anomaly detection, network segmentation and rapid response to address exposed industrial devices.
Article Details
- Event Type
- Reported cyberattack targeting supermarket refrigeration systems through internet-connected controllers
- Impact
- Public reports say hundreds of supermarkets in France were affected after refrigeration settings were changed, causing significant disruption; reported losses reached several million euros. The attack's access method has not been confirmed. Researchers warn that exposed industrial interfaces may also enable operational disruption, equipment damage, or financial losses.
CVE
Vendors
Copelandwith no authentication, weak credentials, or default credentials. As shown in Figure 1, an exposed Copeland XWEB web interface, used to manage Dixell equipment, including refrigerators, can provide the ability toDanfossand password being the current date. Researchers from Claroty’s Team82 identified a vulnerability in Danfoss AK-SM 8xxA Series in 2025, “CVE-2025-41450", allowing for administrative access using a time-basedDixellor default credentials. As shown in Figure 1, an exposed Copeland XWEB web interface, used to manage Dixell equipment, including refrigerators, can provide the ability to remotely control connected devices.Rockwell AutomationDuring our research, we identified publicly accessible web interfaces belonging to PLCs, including Rockwell Automation Allen-Bradley devices. In each case, the risk arises from how the devices have been deployed andWAGOaccessible, often protected only by weak credentials. Figure 2 shows an example of a publicly exposed WAGO interface. The WAGO management interface is a configuration and administration panel for controllers.
Products
Allen-Bradley CompactLogixFigure 3: Web interface for Allen-Bradley CompactLogix controller.Copeland XWEBwith no authentication, weak credentials, or default credentials. As shown in Figure 1, an exposed Copeland XWEB web interface, used to manage Dixell equipment, including refrigerators, can provide the ability toDanfoss AK-SM 8xxA Seriesbeing the current date. Researchers from Claroty’s Team82 identified a vulnerability in Danfoss AK-SM 8xxA Series in 2025, “CVE-2025-41450", allowing for administrative access using a time-based