So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.

The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.

As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:

  uchar check_code_of_the_day(LPCTSTR pass) {
    uchar uVar1;
    LPCTSTR pass_local;
    DATE_STRUCT date;
    INT32 tothex;
    INT32 hex;
    UTF8_STR buff;

    Get_syst_current_tds(&date);
    ftext_s(buff,0x1ff,"%02d%02d%02d%02d",date.month,date.day,date.year,date.month);
    sscanf(buff,"%lx",&tothex);
    ftext_s(buff,0x1ff,,date.day);
    sscanf(buff,"%lx",&hex);
    tothex = __aeabi_idiv(tothex,hex);
    ftext_s(buff,0x1ff,"%05ld",tothex % 100000);
    if ((((*pass == buff[0]) && (pass[1] == buff[1])) && (pass[2] == buff[2])) &&
       ((pass[3] == buff[3] && (pass[4] == buff[4])))) {
      uVar1 = '\x01';
    }
    else {
      uVar1 = '\0';
    }
    return uVar1;
  }

[1] https://www.claroty.com/team82/research/freeze-the-controlle...

[2] https://www.danfoss.com/en-us/service-and-support/downloads/...

▲ floro 2 hours ago | parent | next [-]

"like it's the 90s again" - it probably was made in the 90s. Working with industrial systems it doesn't surprise me at all.

▲ missmewiththatl 7 hours ago | parent | prev | next [-]

I'm was super glad I could just copy/paste that code in my LLM-of-choice and it gave me a reasonable explanation of how to exploit it. Thank god an attacker couldn't do that.

▲

amluto 6 hours ago | parent | next [-]

This doesn’t require any fancy analysis. You can literally read the password off it — the last bit is an oddly decompiled string comparison.

▲

bryanrasmussen an hour ago | parent | next [-]

Not everybody writes in the language they want to exploit I suppose, that's the great thing about LLMs!

on edit: even though I don't know C or C++ (I suppose it's C but can't be sure) I do think I can figure out what it's doing and how to guess what the password is, so that seems bad.

▲

lifeisloving 3 hours ago | parent | prev [-]

Well most SWEs need an llm to spell their own name now.

	▲	vasco 2 hours ago \| parent [-]
		Claude disagreed with this take but I'm but I'm not sure it's true myself.

▲

imjonse 2 hours ago | parent | prev [-]

The fact that Russia has access to LLMs that could decompile and explain this firmware ( and possibly even translate the explanation to Russian! ) is just another proof that this was definitely part of the hybrid war and Europe needs to spend a few more tens of billions on weapons and possibly impose restrictions on open weight LLMs.

	▲	zelphirkalt an hour ago \| parent [-]
		That's not a solution. Russia can just take the next LLM rolling out of China. The fix is to not be stupid and fix our broken infrastructure. Especially, IT infrastructure, but also things like idiotically Internet-connected fridges of supermarkets apparently.

▲ isoprophlex an hour ago | parent | prev [-]

What the hell is up with that comparison at the end?! Seems... overly verbose?

▲

nananana9 5 minutes ago | parent | next [-]

The programmer probably wrote memcmp(pass, buf, 5) which compilers will often fold into an inlined loop, or a few comparisons if they know the 3rd arg.

The weird thing is it didn't emit a 32-bit load+compare for the first 4 bytes, this could probably be done with 2 comparsions. Idk. Maybe weird CPU with stricter alignment rules.

▲

Turneyboy an hour ago | parent | prev [-]

Most likely this is decompiled and not the way it was originally written.

	▲	jonatron 26 minutes ago \| parent [-]
		Yep, and you can prompt something like "the function was a decompiled version, translate it into a readable version", if you don't like reading [probably] ghidra output.