When Modbus Meets the WAN: Dissecting Auth-Bypass and Setpoint Overwrites in Edge BMS Controllers

In mid-October 2026, hundreds of commercial refrigeration units across major French grocery chains, including Intermarché and Coopérative U, began warming rapidly in the middle of the night. Instead of maintaining standard commercial freezer storage at -18°C, multiple units swung to an astonishing 50°C. Food rotted on the shelves, plastic fixtures softened, and isolated stores reported localized electrical fires. As documented in post-incident telemetry from the French supermarket refrigeration crisis, the root failure did not stem from enterprise ransomware encrypting back-office databases. Attackers gained access to edge refrigeration controllers—principally Danfoss AK-SM platforms—and executed unauthenticated setpoint overwrites that forced physical cooling infrastructure into sustained, destructive thermal runaway. To understand how an IP packet translates into a 50°C supermarket freezer, we have to look past the web UI and into the architecture of edge Building Management Systems (BMS). Modern retail edge controllers act as translation bridges between the corporate IP network (or the public internet via cellular telemetry modems) and local industrial fieldbuses like Modbus RTU, Modbus TCP, or proprietary RS-485 serial loops. These controllers typically run a lightweight embedded Linux or real-time OS hosting an HTTP daemon for facilities engineers, an embedded database for temperature logging, and an internal supervisory loop that reads and writes registers on remote input/output (I/O) modules controlling compressors, expansion valves, and electric defrost contactors.

The Anatomy of Defrost Thermal Runaway

Commercial low-temperature evaporators collect frost continuously from ambient humidity. To clear this frost, BMS controllers periodically execute a defrost cycle. The controller halts liquid refrigerant flow by closing the liquid line solenoid valve, allows the compressor to pump down remaining suction gas, cuts evaporator fan power to prevent blowing hot air into the food cases, and energizes high-wattage electric resistance heating elements mounted directly along the evaporator fins. Under normal operating conditions, this cycle is bound by two strict termination criteria: an internal failsafe timer (typically 30 to 45 minutes) and a defrost termination temperature sensor (typically terminating the cycle when the evaporator coil reaches 5°C to 10°C).

TEXT

[ WAN / Edge Router ] 
         | (HTTP Auth-Bypass / API Flaw)
         v
[ BMS Controller: Danfoss AK-SM ]
   +- Web Daemon / Session Manager (Vulnerable)
   +- Fieldbus Master (Modbus TCP/RTU)
         |
         +- Coil Register 0x0120 (Defrost Relay) --> [ FORCED ON (1) ]
         +- Holding Register 0x0410 (Cut-in Temp)  --> [ OVERWRITTEN: +50°C ]
         +- Register 0x0418 (Safety Timer Max)   --> [ OVERWRITTEN: 999 min ]

When an authentication-bypass vulnerability allows arbitrary requests to slip through the embedded web service, the web daemon directly invokes backend supervisory APIs. By submitting crafted payloads to unauthenticated endpoints, an external actor can mutate internal configuration parameters: overriding temperature cut-in setpoints to maximum limits, setting the defrost termination timer to an indefinite maximum, and asserting manual actuator overrides on the defrost relay coils. With the electric resistance heaters pegged at 100% duty cycle, evaporator fans suppressed, and no refrigerant flowing to pull heat away, the freezer enclosure stops being a refrigerator and effectively becomes an industrial convection oven.

Where Architectural Safety Assumptions Break Down

The most glaring vulnerability in these environments is not just software defects in legacy vendor firmware; it is the failure to maintain independent safety domains. In classical process automation, software control loops are never trusted with ultimate life or asset safety. If a digital output commands an electric heater on, an independent, hardwired bimetallic thermostat or one-shot thermal fuse wired in series with the contactor coil must mechanically break the circuit if surface temperatures exceed safe thresholds (such as 35°C). In high-volume commercial retail buildouts, cost-engineering and installation shortcuts frequently bypass this separation. Installers often rely entirely on the BMS software logic—trusting the controller's analog thermistor inputs and its software timers to handle cutoffs. When an attacker corrupts holding registers or forces manual output overrides, the embedded software disables its own safety monitoring routines. Without an electromechanical interlock wired downstream of the controller's solid-state or mechanical relays, there is zero physical friction preventing thermal runaway.

TEXT

[ Dangerous: Pure Software Control ]
BMS Controller Relay ---------------> [ Defrost Contactor Coil ] --> [ Heaters ON ]

[ Resilient: Physical Safety Interlock ]
BMS Controller Relay --[ Bimetal Thermal Switch (Open @ 30°C) ]--> [ Contactor Coil ]

Protocol Insecurity and Ingress Traps

The second architectural breakdown occurs at the transport and network layer. Modbus TCP has no native concept of authentication, encryption, or role authorization. If an edge BMS controller exposes its Modbus service (port 502) or an embedded management portal (port 80 or 443) directly to an unsegmented store network or a cellular SIM gateway with a dynamic public IP, the barrier to entry is completely demolished. Field maintenance teams routinely deploy 4G/5G cellular modems for out-of-band monitoring to sidestep strict corporate IT firewalls. When these modems are provisioned with public static IPs or lack carrier-grade NAT, network reconnaissance tools sweep them up within minutes. Once an actor accesses the management daemon, they do not need to exploit memory-corruption bugs or gain an interactive shell. The target controller's built-in engineering diagnostic tools are purpose-built to issue raw fieldbus commands, allowing the attacker to toggle relays and overwrite setpoints using standard, manufacturer-provided features.

Isolating Fieldbus Control Loops

Fixing this systemic risk requires strict physical and logical network separation. Industrial control planes must never share ingress paths with diagnostic web servers. If an edge controller must be accessible for maintenance, that access must terminate on a dedicated edge gateway terminating mutual TLS (mTLS) or an authenticated WireGuard tunnel, with zero direct ingress routes to the controller's loopback or fieldbus ports.

BASH

# Drop incoming unauthenticated Modbus TCP traffic on the edge WAN interface
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet filter input iifname 'wg0' tcp dport 502 accept
nft add rule inet filter input iifname 'eth0' tcp dport { 80, 443, 502 } drop

At the fieldbus boundary, ingress controllers should implement strict layer-7 protocol sanitization. Even within an authenticated maintenance session, standard monitoring systems only require read operations. Fieldbus proxy gateways should enforce read-only policies by dropping Modbus function codes 0x05 (Write Single Coil), 0x06 (Write Single Register), 0x0F (Write Multiple Coils), and 0x10 (Write Multiple Registers), unless an authorized maintenance state is physically enabled via an on-site mechanical keyswitch. When critical industrial assets are coupled to network stacks, the physical reality of the machine cannot be divorced from packet-level guarantees. As supermarket operators across Western Europe discovered, treating a facilities controller like an ordinary IoT dashboard creates a direct pipeline between trivial web exploits and destroyed physical inventory. The line between software bugs and physical damage is determined entirely by whether your network enforces isolation, and whether your mechanical plant includes independent hardware interlocks that can say no to software.