CVE-2025-41450: Broken Authentication in Danfoss AK-SM

CVE-2025-41450 is an Improper Authentication vulnerability affecting Danfoss AK-SM 8xxA Series systems, which control temperature monitoring in cold-chain distribution centers and retail facilities. The flaw allows attackers to bypass authentication mechanisms and gain access to industrial control systems, compromising monitoring data integrity and physical control of refrigeration infrastructure. This CVE has direct impact on organizations dependent on global refrigerated supply chains.

CVSS severity is 8.2 (high). The vulnerability affects AK-SM 8xxA versions prior to 4.2. A GitHub signal dated November 2, 2026 documents a technical post-mortem linked to the October 2026 Fromagegate incident, which affected international retail supply chains: this provides evidence of active exploitation in real attacks on critical OT infrastructure. The declared high severity is confirmed and patch status is available.

System administrators and IT teams must immediately audit their inventory to identify Danfoss AK-SM 8xxA systems prior to version 4.2, prioritize updating to version 4.2 or later, and validate that authentication controls have been properly restored post-patch. For complex OT environments, implement network segmentation, network access controls, and audit logging on control system access. Consult the OT defensive blueprint in the GitHub post-mortem for specific hardening practices.