DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

The Port Split Is the Refrigeration Inventory You Can Act On

#security #zoomeye #ot #exposure

The Port Split Is the Refrigeration Inventory You Can Act On

A global count tells you that refrigeration controllers are reachable. It does not tell you where to put a control. Splitting the same population by port and address class turns a number into a short list of places where a compensating control would actually sit.
The population in question comes from the 11 October 2026 attack on cooling systems at hundreds of French supermarkets, in which Danfoss confirmed its equipment was targeted. Censys counted 2,991 internet-exposed StoreView control panels that day, 1,825 in France, and observed a 71% fall in the French figure by 14 October. The ZoomEye header query below is a different instrument run on 22 October 2026, and it is used here for its structure rather than for comparison with the Censys total.
| Query | Result |
| --- | --- |
| http.header="Danfoss" | 260 |
| http.header="Danfoss" && port="80" | 120 |
| http.header="Danfoss" && port="443" | 132 |
| http.header="Danfoss" && port="8080" | 0 |
| http.header="Danfoss" && port="502" | 0 |
| http.header="Danfoss" && port="23" | 0 |
| http.header="Danfoss" && port="21" | 0 |
| http.header="Danfoss" && is_ipv4=true | 138 |
| http.header="Danfoss" && is_domain=true | 122 |

What the ports say

Every asset this query returns is reachable over HTTP on either port 80 or port 443. The two counts sum to 252 against a total of 260. An eight-unit residual means the port split is close to exhaustive, though a host answering on both ports would be counted twice, so the residual cannot be read as eight specific devices.
That matters for remediation sequencing. Plain HTTP on port 80 means credentials and session tokens travel unencrypted unless something in front of the panel terminates TLS. Port 443 means TLS is present, which says nothing about certificate validity, firmware age or authentication strength. A panel behind HTTPS with a self-signed certificate from 2019 is still a panel running the firmware it shipped with.
The absence of high ports is its own finding. Nothing in this population answered on 8080, the usual alternate management port. If an estate were being accessed through a non-standard web port or a tunnel, this query would not show it.

What the zero counts do not mean

The zeros on 502, 23 and 21 deserve a careful reading, because they are the easiest results in the table to over-interpret. Port 502 is Modbus TCP, port 23 is Telnet and port 21 is FTP. A reader could conclude that no Danfoss refrigeration equipment speaks Modbus, offers Telnet or exposes FTP.
That conclusion is not supported. The query is an AND: it requires a response header containing the vendor name and the specified port. A controller whose Modbus service is separate from its web interface, and whose port 502 listener does not emit an HTTP header, will never appear in a query that requires an HTTP header. The zeros describe the intersection, not the device.
This is the same trap as the interface fingerprint. Earlier probes for app="Danfoss StoreView", app="StoreView" and product="Danfoss" all returned zero, which says the fingerprint is absent from this engine and nothing about the devices. Two different kinds of zero, both of them statements about the query.
The practical rule: treat a zero as evidence about coverage only after confirming that the matched field could plausibly appear on the asset in question.

The address class split, and who owns the next step

The is_ipv4 and is_domain results, 138 and 122, add up to exactly 260. That partition is the most operationally useful line in the table because it separates two different ownership conversations.
An asset addressed by IP is typically a device on a fixed connection, often with a static address, and often the panel an on-site technician reaches directly. An asset reachable through a hostname usually sits behind DNS, which means somebody controls that record, and that record can be changed or removed without touching the device. For a retailer with hundreds of sites, the hostname group is where a DNS-level control can be applied quickly; the IP group is where a network control or a device change is required.
Neither group is the vulnerable group. Censys reported that 74% of French exposed instances ran below version 4.3.1 on 11 October, the release covering CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, with Poland at 81%, Romania at 80% and Belgium at 76%. No external scan reproduces those percentages, because firmware version is not visible from outside.

Building the short list

A defensible sequence for a refrigeration fleet owner, using a public engine and no vendor access:

  1. Run the base query and the two port splits on the same day. Record all three counts and the timestamp. The relationship between them is the diagnostic, not any single figure.
  2. Pull the address class split. Route hostname-addressed panels to whoever owns DNS, and IP-addressed panels to whoever owns the site network.
  3. Probe a country filter for each country where you operate. The global country distribution here skews to the Netherlands at 54 and the United States at 28, with Germany at 25 and France at 1, which is a property of the header string rather than a statement about where risk lives.
  4. Verify on the device. Port and hostname indicate where to look; version, authentication and exposed services come from the controller or its owner. ZoomEye is useful at step one because the query is short, repeatable and cheap to re-run after a change. It is not useful as a substitute for step four, and the zeros in the table are the clearest reminder of why: they report the shape of the index, not the shape of the fleet.

References

Top comments (0)