Danfoss
13 CVEs across 7 Danfoss products. Browse Danfoss vulnerabilities, severities, and proof-of-concept exploits.
Danfoss products with known CVEs
Danfoss CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-41452 | | | 2025-08-22 | Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow f… |
CVE-2025-41451 | | | 2025-08-22 | Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4… |
CVE-2025-41450 | High | 8.2 | 2025-05-08 | Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2 |
CVE-2023-25915 | Critical | 9.9 | 2023-08-21 | Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system. |
CVE-2023-25914 | High | 8.8 | 2023-08-21 | Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information t… |
CVE-2023-25913 | High | 7.5 | 2023-08-21 | Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, u… |
CVE-2023-25912 | Medium | 5.3 | 2023-06-11 | The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the… |
CVE-2023-25911 | Critical | 9.9 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters. |
CVE-2023-22586 | High | 7.7 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter. |
CVE-2023-22585 | Critical | 9.0 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter. |
CVE-2023-22584 | High | 7.5 | 2023-06-11 | The Danfoss AK-EM100 stores login credentials in cleartext. |
CVE-2023-22583 | Critical | 10.0 | 2023-06-11 | The Danfoss AK-EM100 web forms allow for SQL injection in the login forms. |
CVE-2023-22582 | Critical | 9.0 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting. |