Title: An Unsupported Controller Represents a Budgetary Concern, Not Just a Patch Issue
In a significant development concerning industrial cybersecurity, Claroty’s Team82 recently uncovered three vulnerabilities in Danfoss’s prevalent AK-SM 800A refrigeration controllers. Published in August, their findings revealed that these flaws, which were addressed in firmware updates prior to version 4.3.1, aligned with a concerning statistic: approximately 2,765 management interfaces are accessible over the internet. Noteworthy, however, is that these vulnerabilities have yet to be conclusively linked to any specific cyberattack incidents. Danfoss has been proactive in communicating that most of the affected controllers are older models—the AK-SM 800 and AK-SC 355—highlighting that some units of the AK-SM 800A may also be operating on outdated firmware.
Compounding the dilemma for users of these older models is the stark reality that no patches are available. Danfoss officially ceased updates for the AK-SM 800 back in May 2021 and for the AK-SC 355 in 2016. Consequently, the French Computer Emergency Response Team (CERT-FR) has shifted its focus from patching vulnerabilities to more practical advice for operators. Their directive urges the immediate removal of all AK-SM, AK-SC, and XWEB controllers from the public internet. Operators are advised to restore access exclusively through a Virtual Private Network (VPN) or a secure internal network. For those Danfoss units suspected of being compromised, CERT-FR suggests a range of remedial actions—such as restarting the device or, as a last resort, performing a factory reset and reconfiguring it before bringing it back online. They stress a critical warning: simply resetting a device may eliminate immediate threats, but leaves the system susceptible to future vulnerabilities, indicating that the ongoing risk from cyber campaigns remains.
This situation underscores a methodical approach that aligns closely with a recommendation previously articulated concerning Siemens S7 Programmable Logic Controllers (PLCs) by CISA (Cybersecurity and Infrastructure Security Agency). The recommended sequence—prioritizing exposure controls, updating firmware, and ultimately, planning for replacements—seems vital in this context. The implication here is a call for immediate action: by the end of the week, operators should create a comprehensive inventory of every refrigeration controller categorized by model, firmware version, and vendor support status. It is paramount to ensure that any management interface linked to a public IP address is removed immediately. Furthermore, updating firmware on all supported equipment is equally crucial, while planning for replacements For unsupported devices must also be undertaken, complete with budgetary considerations.
Operating with aging technology has its merits; machines like the AK-SM 800 might still perform their intended functions seamlessly. However, the financial ramifications associated with equipment updates—monetary expenditure, engineering resources, and operational downtime—can deter users from making timely replacements. In such cases, decision-making often falls into a bureaucratic limbo. Responsibly managing this risk requires collaboration between security and commercial teams. While the security team documents the potential risks associated with outdated systems, there must exist a designated individual on the commercial side who can make the financial decisions necessary for upgrades or replacements.
As is evident from the recent warnings and advice from various cybersecurity bodies, potential stakeholders must also be aware of how their decisions can impact not only their immediate operational security but also their broader financial standing. Information reported by credible sources, such as recent insurance assessments, further emphasizes the widespread acceptance of risk associated with outdated technologies—what could otherwise present a grave cybersecurity concern. It is imperative for organizations to recognize that maintaining a comprehensive view of their technological assets is just as crucial as protecting them from cyber threats.
Ultimately, the vulnerabilities present in these refrigeration controllers serve as a stark reminder: without a decisive approach that encompasses not just immediate remediation but also a strategic, long-term commitment to operational safety, organizations risk facing larger and more costly threats in the future.