{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/danfoss/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AK-SM series","AK-SC series"],"_cs_severities":["high"],"_cs_tags":["ics","ot","vulnerability","exposure"],"_cs_type":"advisory","_cs_vendors":["Danfoss"],"content_html":"\u003cp\u003eThe French National Cybersecurity Agency (ANSSI) has issued an alert regarding numerous observed compromises of Danfoss AK-SM and AK-SC series controllers. The primary vector for these incidents is the exposure of device management interfaces directly to the public internet, which facilitates unauthorized access. These devices, commonly used in industrial or facility management, are highly vulnerable when reachable without proper perimeter protection. Defenders are urged to immediately audit internet-facing exposures of these controllers. In cases where remote administration is strictly required, ANSSI recommends strictly restricting access to a list of trusted IP addresses via network access control lists (ACLs).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full compromise of the affected controllers. Given the nature of these devices, which are typically used for industrial control and monitoring, a compromise may lead to loss of availability, unauthorized manipulation of the controlled environment, or lateral movement into broader operational technology networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately disconnect all Danfoss AK-SM and AK-SC series controllers from the public internet.\u003c/li\u003e\n\u003cli\u003eImplement strict network-level filtering to allow access only from authorized and trusted management IP addresses.\u003c/li\u003e\n\u003cli\u003eIf compromise is suspected, conduct a full factory reset (Factory Reset) and reconfigure the equipment globally.\u003c/li\u003e\n\u003cli\u003ePerform a mandatory rotation of all system credentials and audit user accounts for unauthorized modifications.\u003c/li\u003e\n\u003cli\u003eApply all available security patches provided by the vendor to remediate known vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:29:24Z","date_published":"2026-10-12T18:29:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-danfoss-compromise/","summary":"CERT-FR reports widespread compromises of Danfoss AK-SM and AK-SC series controllers resulting from the exposure of management interfaces directly to the internet.","title":"Security Incidents Targeting Danfoss AK-SM and AK-SC Series Controllers","url":"https://feed.craftedsignal.io/briefs/2026-10-danfoss-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - Danfoss","version":"https://jsonfeed.org/version/1.1"}