Skip to content
OpenAdvisories
High ICSA-25-140-03 3 CVEs

Danfoss AK-SM 8xxA Series (Update A)

Published May 20, 2025 · Updated Aug 26, 2025 · Revision 2

Vendor: Danfoss Product: AK-SM 8xxA Series

Summary

Successful exploitation of these vulnerabilities could enable a remote attacker to bypass authentication and remotely execute arbitrary code.

Vulnerabilities 3

  • High 8.7
    CVE-2025-41451

    Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series

    Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.

    Danfoss AK-SM8xxA Series
  • High 8.2
    CVE-2025-41450 Public exploit

    Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2

    Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2

    Danfoss AK-SM 8xxA Series
  • Medium 6.8
    CVE-2025-41452

    Post auth nginx configuration injection in Danfoss AK-SM8xxA Series

    Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions

    Danfoss AK-SM8xxA Series

Revision history

  1. #2

    Update A - Added CVE-2025-41451 and CVE-2025-41452

  2. #1

    Initial Publication

References