Short answer: A cyber-attack raised the temperature in French blood storage rooms to 110°C, affecting three facilities. The French Blood Establishment and Coolworld Rentals confirmed the incident but stated there was no loss of blood products. Stay informed and report any cybersecurity issues to relevant authorities.
TL;DR
- Cyber-attack targeted refrigeration systems in French blood storage rooms.
- Temperature in affected rooms reached 110°C.
- No loss of blood products reported.
- Incident detected and handled quickly by EFS.
What is CVE-2025-41450?
This incident involves a cyber-attack on refrigeration systems used to store blood and other samples in France. Attackers raised the temperature in some storage rooms to 110°C, but the French Blood Establishment (EFS) managed to detect and address the issue in time, preventing any loss of blood products. The attack highlights the vulnerability of critical infrastructure to cyber threats.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | Infosecurity Magazine |
|---|---|
| Date reported | 04 Nov 2026 |
| CVE | CVE-2025-41450 |
| CVSS | 8.2 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H |
| Weakness | CWE-305 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | www.danfoss.com |
| CVE | CVE-2025-41451 |
| CVSS | 8.7 HIGH CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-77 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Affected product | France Blood Service Cyber-Attack |
| Published in NVD | 2025-05-08 (CVE-2025-41450) |
| Published in NVD | 2025-08-22 (CVE-2025-41451) |
How it works
Attackers exploited a flaw in remote monitoring software. The software controlled temperature settings in refrigerators. This allowed them to raise the temperature to dangerously high levels, threatening blood safety.
- Attacker reaches the target over the internet
- No login or account is needed
- A user must open a link or file first
- Sends crafted input that triggers the flaw
- Impact: data can be read, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2025-05-08 | CVE-2025-41450 published in NVD | NVD |
| 2025-08-22 | CVE-2025-41451 published in NVD | NVD |
| 2026-11-04 | Reported by Infosecurity Magazine | Infosecurity Magazine |
| 2026-11-09 | This Skillmate explainer published | Skillmate |
How to fix it
- Update France Blood Service Cyber-Attack to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2025-41450 and upgrade to the fixed release it lists.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders should look for unusual temperature readings in cold storage rooms and alarm notifications. A false positive might be a scheduled maintenance that raised the temperature temporarily.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2025-41450 is a real NVD record scored 8.2 HIGH | CISA KEV does not list CVE-2025-41450 as exploited in the wild |
| CVE-2025-41451 is a real NVD record scored 8.7 HIGH | CISA KEV does not list CVE-2025-41451 as exploited in the wild |
| Reported by Infosecurity Magazine | NVD links no vendor advisory for CVE-2025-41451 yet |
| Reported by BleepingComputer |
Why it matters
This attack shows critical infrastructure is at risk. It highlights the need for robust cybersecurity in healthcare and refrigeration systems. Students and companies must learn to protect sensitive equipment.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What caused the temperature increase?
Hackers remotely manipulated the temperature settings in the refrigeration systems.
Was any blood lost?
No, the issue was detected quickly and blood products were moved to safe storage.
Who was affected?
The French National Blood Service, EFS, was affected, with three of its sites impacted.
What vulnerabilities were exploited?
Vulnerabilities in a third-party component were exploited, specifically CVE-2025-41450 and CVE-2025-41451.
Sources
- France Blood Service Cyber-Attack Sends Blood Storage Temperatures to 110 C (Infosecurity Magazine)
- Cyberattack disrupts blood storage refrigeration systems in France (BleepingComputer)
- Vendor advisory CVE-2025-41450 (www.danfoss.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.