Recent cyberattacks targeting refrigeration systems at several French supermarket chains highlight the risks associated with exposing industrial equipment to the Internet. Against this backdrop, ONYPHE conducted an investigation into publicly accessible Danfoss StoreView Browser management interfaces.
Background and Attack Surface
During the night of October 11–12, 2026, several hundred French supermarkets were targeted by a cyberattack affecting their Danfoss refrigeration systems. According to initial reports, the attackers allegedly managed to trigger forced defrost cycles, disrupting temperature regulation and causing the loss of refrigerated goods.
Danfoss AK-SM 800 and AK-SM 800A controllers provide centralized monitoring and management of refrigeration installations. Their management environment allows operators to monitor equipment, adjust temperature setpoints, review alarms, and remotely configure operating parameters. Three solutions are available for accessing these controllers: StoreView Browser, StoreView Desktop, and StoreView Web.
Both StoreView Browser and StoreView Web provide web-based access. When directly exposed to the Internet, these interfaces expand the attack surface of systems that control physical processes. The main distinction is that StoreView Browser is hosted locally within the retailer’s infrastructure, whereas StoreView Web is centralized and hosted by Danfoss. This article focuses specifically on the Internet exposure of StoreView Browser.
This exposure is closely related to how refrigeration systems are maintained. Unlike traditional IT assets, these controllers are often managed by external contractors responsible for their installation and maintenance, outside the retailer’s usual IT security and monitoring processes. As a result, responsibilities are distributed among on-site technical teams, external service providers, and potentially the organization’s central IT department. In this environment, direct access to a web interface offers a convenient solution for refrigeration technicians, allowing them to perform remote maintenance without deploying a VPN infrastructure or systematically involving the customer’s IT department in network access configuration. The same access channel designed to simplify maintenance can therefore become a potential entry point for attackers.
In August 2026, Claroty Team82 published an analysis of the AK-SM 800A controller, identifying several vulnerabilities affecting its management interface: an authentication bypass (CVE-2025-41450), a command injection vulnerability enabling authenticated remote code execution (CVE-2025-41451), and an Nginx configuration injection vulnerability potentially leading to denial of service (CVE-2025-41452). At the time of writing, none of these vulnerabilities has been confirmed as an attack vector in the October 2026 incidents.
The analysis of ONYPHE data aims to assess the scale of Internet exposure, identify the controller generations where possible, and evaluate the presence of outdated or potentially vulnerable software versions.
Mapping Internet-Exposed StoreView Interfaces
Detection Methodology
To measure the Internet exposure of Danfoss StoreView interfaces, ONYPHE analyzed HTTP and HTTPS scan data, correlating four types of indicators:
- Favicon: identification of favicon fingerprints associated with StoreView interfaces.
- HTML title: identification of characteristic page titles referencing StoreView.
- TLS certificates: analysis of certificate fields and fingerprints to identify recurring signatures, including the Subject Common Name
DanfossSM800A. - HTTP headers: identification of a characteristic HTTP header shared across StoreView instances.
The corresponding results can be explored directly using ONYPHE:
Explore exposed Danfoss systems on ONYPHE
Scale of Exposure
ONYPHE’s analysis identified several thousand Internet-accessible StoreView interfaces over a period of less than one week.
The observed dataset includes:
- 6,212 unique public IP addresses
- 558 distinct Autonomous Systems (ASNs)
- 95 countries and territories
For comparison, Claroty Team82’s August 2026 research reported 2,765 exposed devices identified through Censys.
These figures should, however, be interpreted with caution. A single IP address may host multiple management services, while several devices may be accessible behind a NAT gateway or proxy. The number of detected interfaces therefore does not necessarily correspond to the number of physical controllers deployed.
Furthermore, identifying a StoreView interface alone does not reveal the exact model of the underlying controller or establish whether it is running a vulnerable firmware version.
Distribution by ASN and TCP Port
Analyzing Autonomous Systems helps identify the networks hosting the largest concentrations of exposed interfaces.
The main networks identified include:
- Orange (AS3215)
- Proximus (AS5432)
- Orange Polska (AS5617)
- Telenet (AS6848)
- Comcast (AS7922)
- KPN (AS1136)
- Polkomtel (AS8374)
- Deutsche Telekom (AS3320)
- Telefónica España (AS3352)
- T-Mobile Polska (AS12912)
- SFR (AS15557)
This distribution shows that exposure is concentrated primarily within consumer and business telecommunications networks rather than traditional hosting infrastructures. Several business-focused network operators are also represented. This pattern is consistent with controllers deployed directly at supermarkets, retail facilities, or refrigerated warehouses and made accessible through port-forwarding rules configured on the site’s Internet router, often to facilitate remote maintenance by installation contractors. Beyond the leading operators, exposure is highly fragmented across 558 distinct ASNs, with none other than Orange and Proximus accounting for more than a few percent of the total.
The analysis of TCP ports reveals similarly heterogeneous remote access configurations. Fewer than half of the detected interfaces use a conventional web port (80, 443, or 8080). Most are exposed through non-standard ports, suggesting individually configured port-forwarding rules. Using non-standard ports provides no meaningful protection against discovery: these services are indexed by ONYPHE and other Internet-wide scanning platforms just like services running on standard ports. Additionally, a substantial proportion of interfaces are accessible over unencrypted HTTP. When authentication is performed over such connections without an additional secure transport layer, credentials may be transmitted in cleartext.
Geographic Distribution
The exposed StoreView instances are distributed across 95 countries and territories, with France accounting for nearly half of the identified IP addresses. Belgium, Poland, the United States, the Netherlands, and Spain follow.
This geographic concentration is consistent with Danfoss’s commercial presence and the deployment of its systems through refrigeration integrators serving the European retail sector, particularly in France.
Software Version Analysis and Obsolescence
Identifying StoreView Browser Versions
Beyond mapping exposed interfaces, the data collected by ONYPHE can also be used to analyze the versions of Danfoss StoreView Browser accessible from the Internet.
Version information retrieved from HTTP responses to the /SVB5.ver endpoint allows different StoreView Browser releases to be identified.
Extracting and normalizing this information makes it possible to compare deployments and determine which software versions are most prevalent.
The objective is to assess version diversity and identify the continued use of older StoreView Browser releases on publicly accessible management interfaces.
Distribution of Observed Versions
ONYPHE’s results reveal significant heterogeneity among exposed StoreView Browser versions.
Several findings stand out:
- 12 distinct StoreView Browser versions were identified.
- The newest observed version,
01.0.170, remains rarely deployed. - The oldest observed version is
01.0.124. - Version
01.0.168is the most common, accounting for approximately half of the interfaces. - More than half of the interfaces are running versions older than
01.0.168.
This distribution highlights the coexistence of relatively recent and considerably older software releases, with outdated versions still widely represented among publicly accessible interfaces.
Although software age alone does not establish the presence of an exploitable vulnerability, the continued exposure of older versions raises questions about update practices and the long-term maintenance of refrigeration management systems.
Conclusion
This investigation highlights the scale of Internet exposure affecting Danfoss StoreView Browser interfaces, as well as the continued presence of outdated software versions and potentially insecure remote access configurations. The predominance of telecommunications networks and the wide variety of exposed TCP ports suggest that many refrigeration installations are directly accessible through the Internet connections of the sites operating them, most likely to facilitate remote maintenance.
The recent cyberattacks targeting refrigeration systems at several French supermarket chains illustrate the real-world consequences of compromising operational technology (OT) environments. Unlike conventional cyberattacks primarily targeting information systems, these incidents can have direct physical consequences: disruption of temperature regulation, breaches of the cold chain, and the destruction of perishable goods.
The concentration of reported incidents in France also raises the possibility of a campaign specifically targeting the country and a strategic resource: its fresh food supply. By targeting the infrastructure responsible for preserving perishable products, an attacker could seek to inflict economic losses, disrupt food distribution, and potentially undermine consumer confidence.
This remains a hypothesis rather than an established conclusion. At this stage, neither the attackers’ strategic intentions nor the precise technical intrusion vector has been publicly confirmed. Likewise, ONYPHE’s findings do not establish a direct connection between the exposed interfaces identified during this investigation and the systems compromised in the recent attacks.
