DEV Community

StarkMan
StarkMan

Posted on

What 260 Danfoss Headers Reveal About Refrigeration Exposure

#security #zoomeye #danfoss #exposure

What 260 Danfoss Headers Reveal About Refrigeration Exposure

On 11 October 2026, cooling systems at hundreds of French supermarkets came under a cyber-attack that Danfoss confirmed had targeted its equipment. Censys counted 2,991 internet-exposed Danfoss StoreView control panels worldwide that day, 1,825 of them in France, then watched the French figure fall 71% within three days as operators pulled panels off the public internet rather than patch them.
The number matters less than the method. A team that owns refrigeration, building management or cold-chain equipment can repeat a simpler measurement in a few minutes and learn whether its own estate is visible from outside.

Why the obvious fingerprint fails

The natural first query is an application fingerprint. It does not work here. ZoomEye returns zero for app="Danfoss StoreView", app="StoreView", app="Danfoss" and product="Danfoss". Those zeros are a coverage statement, not a finding about the internet. A product name in a news article is a candidate value, never proof that a fingerprint exists.
Title matching fails the other way, by being far too wide. title="Danfoss" returns 27,287 results and title="StoreView" returns 17,384. Both pull in vendor pages, distributor catalogues, news articles and unrelated sites that happen to use the word. Neither describes a controller.
The workable middle ground is the HTTP response header. http.header="Danfoss" returned 260 assets when run on 22 October 2026:
| Query | Result |
| --- | --- |
| http.header="Danfoss" | 260 |
| http.header="Danfoss" && port="80" | 120 |
| http.header="Danfoss" && port="443" | 132 |
| http.header="Danfoss" && is_ipv4=true | 138 |
| http.header="Danfoss" && is_domain=true | 122 |
| http.header="Danfoss" && country="US" | 28 |
| http.header="Danfoss" && country="NL" | 54 |
| http.header="Danfoss" && country="DE" | 25 |
| http.header="Danfoss" && country="FR" | 1 |
Two structural facts fall out of the table. The IPv4 and domain subsets add up to exactly 260, consistent with these being disjoint asset classes: 138 assets addressed by IP and 122 reached through a hostname. The two port queries together return 252, eight short of the total. A device serving both plain HTTP and HTTPS is counted twice, so that residual is not necessarily eight distinct hosts.
Model-level and body-level searches are too narrow to describe an estate. title="AK-SM" returns 2 results, title=="StoreView" returns 1 and body="StoreView" returns 2.

What the measurement does and does not say

The 260 is an exposure count for one header string. It is not the number of vulnerable controllers and not the number of compromised ones. Censys reached 2,991 with a different fingerprint and a different scanning method, and the gap between the two figures is the most useful warning in this data set.
The country split makes the same point. Censys placed 1,825 of the exposed panels in France. The ZoomEye header query finds one French asset alongside 54 in the Netherlands, 28 in the United States and 25 in Germany. Neither number is wrong. One search engine recognises the StoreView interface; the other matches a header the device emits. A team that used only the header query and concluded France was unaffected would be badly misled.
No external scan reads firmware. Censys reported that 74% of French exposed instances sat below version 4.3.1 on 11 October, the release that addresses all three 2025 vulnerabilities, with Poland, Romania and Belgium worse at 81%, 80% and 76%. Those are Censys observations from its own telemetry, not something ZoomEye reports. Whether a given panel carries CVE-2025-41450, CVE-2025-41451 or CVE-2025-41452 has to be answered on the device.

Turning the query into a decision

The value of a public measurement engine here is repeatability rather than absolute accuracy. Three steps follow from the data:

  1. Establish a baseline. Run the header query on 22 October, record the count, the timestamp and the exact string. A later comparison is worthless without the same query and date.
  2. Split the population before acting. Port, address class and country each change who owns the next step. A panel on plain HTTP in one region and a domain-fronted HTTPS panel in another are different conversations.
  3. Confirm on the asset. External counts route attention; firmware version, exposed services and configuration come from the device or its owner. ZoomEye's documented fields such as org, isp and asn are the obvious way to narrow a global result to one organisation. Probe them before relying on them: a field returning zero for a company name says more about the fingerprint than about the company.

Implications

For a retailer, a cold-chain operator or a facilities contractor, the lesson of the French incident is not that 260 assets exist. It is that the outside view of a refrigeration fleet is measurable in minutes, changes measurably after an incident, and rarely matches the vendor figure quoted in the news. Teams that keep their own baseline can tell whether the number falls because operators disconnected panels, because a vendor shipped a fix, or because a scanning method changed.
The starting point is available to anyone. Query the header string, keep the date, and compare next quarter.

References

Top comments (0)