Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2025-41452

Post auth nginx configuration injection in Danfoss AK-SM8xxA Series

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Danfoss
Products
Ak-sm8xxa Series
CVE-2025-41451

Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.

CVSS 4.0 · 8.7 High EPSS 4.5% KEV · Not listed
Vendors
Danfoss
Products
Ak-sm8xxa Series
CVE-2026-15203

Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Danfoss
Products
Ic7-automation Sp Ic7-hybrid Ic7-marine
CVE-2023-25914

Authneticated Path Traversal in Danfoss AK-SM800A

Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Danfoss
Products
Ak-sm 800a Ak-sm 800a Firmware
CVE-2023-25911

Authenticated OS Command Injection in Danfoss AK-EM100

The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.

CVSS 3.1 · 9.9 Critical EPSS 2.2% KEV · Not listed
Vendors
Danfoss
Products
Ak-em100 Ak-em100 Firmware
CVE-2023-25915

Authenticated Remote Command Execution in Danfoss AK-SM800A

Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system.

CVSS 3.1 · 9.9 Critical EPSS 1.0% KEV · Not listed
Vendors
Danfoss
Products
Ak-sm 800a Ak-sm 800a Firmware
CVE-2023-25912

Webreport disclosure to unauthorized actor in Danfoss AK-EM100

The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Danfoss
Products
Ak-em100 Ak-em100 Firmware
CVE-2023-22585

Reflected Cross-Site Scripting in Danfoss AK-EM100

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Danfoss
Products
Ak-em100 Ak-em100 Firmware
CVE-2023-25913

Authentication Bypass in Danfoss AK-SM800A

Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Danfoss
Products
Ak-sm 800a Ak-sm 800a Firmware