Security Incidents Targeting Danfoss AK-SM and AK-SC Series Controllers

The French National Cybersecurity Agency (ANSSI) has issued an alert regarding numerous observed compromises of Danfoss AK-SM and AK-SC series controllers. The primary vector for these incidents is the exposure of device management interfaces directly to the public internet, which facilitates unauthorized access. These devices, commonly used in industrial or facility management, are highly vulnerable when reachable without proper perimeter protection. Defenders are urged to immediately audit internet-facing exposures of these controllers. In cases where remote administration is strictly required, ANSSI recommends strictly restricting access to a list of trusted IP addresses via network access control lists (ACLs).

Impact

Successful exploitation results in full compromise of the affected controllers. Given the nature of these devices, which are typically used for industrial control and monitoring, a compromise may lead to loss of availability, unauthorized manipulation of the controlled environment, or lateral movement into broader operational technology networks.

Recommendation

• Immediately disconnect all Danfoss AK-SM and AK-SC series controllers from the public internet.
• Implement strict network-level filtering to allow access only from authorized and trusted management IP addresses.
• If compromise is suspected, conduct a full factory reset (Factory Reset) and reconfigure the equipment globally.
• Perform a mandatory rotation of all system credentials and audit user accounts for unauthorized modifications.
• Apply all available security patches provided by the vendor to remediate known vulnerabilities.