Danfoss

14 CVEs across 10 Danfoss products. Browse Danfoss vulnerabilities, severities, and proof-of-concept exploits.

Danfoss products with known CVEs

ProductCVEs
Ak-Em1007
Ak-Em100 Firmware7
Ak-Sm 800a3
Ak-Sm800a3
Ak-Sm 800a Firmware3
Ak-Sm8xxa Series2
Ak-Sm 8xxa Series1
Ic7-Automation Sp1
Ic7-Hybrid1
Ic7-Marine1
Danfoss CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-152032026-08-26Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write ac…
CVE-2025-414522025-08-22Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow f…
CVE-2025-414512025-08-22Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4…
CVE-2025-41450High8.22025-05-08Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
CVE-2023-25915Critical9.92023-08-21Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system.
CVE-2023-25914High8.82023-08-21Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information t…
CVE-2023-25913High7.52023-08-21Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, u…
CVE-2023-25912Medium5.32023-06-11The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the…
CVE-2023-25911Critical9.92023-06-11The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.
CVE-2023-22586High7.72023-06-11The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.
CVE-2023-22585Critical9.02023-06-11The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.
CVE-2023-22584High7.52023-06-11The Danfoss AK-EM100 stores login credentials in cleartext.
CVE-2023-22583Critical10.02023-06-11The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.
CVE-2023-22582Critical9.02023-06-11The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.