Censys Finds Hundreds of Exposed Danfoss Controllers After French Supermarket Attacks

Summary

Censys found widespread Internet exposure of Danfoss StoreView controllers after attacks disrupted French supermarket refrigeration. Many exposed devices ran outdated firmware; operators largely removed controllers from the Internet rather than patching them.

Key points

Attackers switched hundreds of French supermarket fridges into defrost mode on October 11, causing food spoilage and, in some cases, fires.
Danfoss said most affected controllers were older models no longer receiving security updates or newer models with outdated firmware; the exact initial access vector is unconfirmed.
CVE-2025-41450 enabled unauthenticated administrator access using a date-derived code. CVE-2025-41451 and CVE-2025-41452 could allow authenticated command execution and disruption.
Censys counted 1,825 exposed StoreView hosts in France on October 11, falling to 537 by October 14. Patched and unpatched groups declined at similar rates, suggesting removal from the Internet rather than patching.
Worldwide, many exposed controllers ran firmware below 4.3.1, which fixes all three CVEs; ten of the twelve countries with the most exposed hosts had more than 60% below that version.
CERT-FR called for immediate removal of the controllers from the Internet. Censys advises they should not be directly Internet-connected.

Article Details

Publisher: Censys
Report Period: 2026-10-10 to 2026-10-14
Scope: Internet-exposed Danfoss StoreView controllers, including firmware versions and changes in exposed-host counts.
Sample Size: All Danfoss StoreView control panels Censys found online; the total reviewed is not stated.
Key Statistics: France: exposed hosts fell from 1,825 on October 11 to 537 on October 14, 2026, a reported 71% decrease.
Outside France: exposed hosts fell from 1,166 to 966 over the same period.
On October 11, the three largest worldwide firmware groups were 3.3.0 (560 hosts), 4.3.1 (511), and 3.2.6 (437).
Ten of the 12 countries with the most exposed hosts had more than 60% of hosts below version 4.3.1; Poland was highest at 81% and Romania at 80%.
The report says attackers switched hundreds of French supermarket fridges into defrost mode on the night of October 11.
Recommendations: Remove the controllers from direct Internet exposure, consistent with the CERT-FR emergency alert.
Where controllers remain in use, apply patched firmware; the article identifies version 4.3.1 or later as fixing all three discussed CVEs.