Vendor
Danfoss
14 known vulnerabilities.
Danfoss at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 1 | 1 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 2 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 1 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
High max 8.7
Danfoss AK-SM 8xxA Series (Update A)
Successful exploitation of these vulnerabilities could enable a remote attacker to bypass authentication and remotely execute arbitrary code.
first May 20, 2025
14 results · Feed
-
Critical 9.3
Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data a…
-
Medium 6.8
Post auth nginx configuration injection in Danfoss AK-SM8xxA Series
Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions
-
High 8.7
Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
-
High 8.2CVE-2025-41450 Public exploit
Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2
Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
-
High 7.5
Authentication Bypass in Danfoss AK-SM800A
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.
-
High 8.8
Authneticated Path Traversal in Danfoss AK-SM800A
Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise.
-
Critical 9.9
Authenticated Remote Command Execution in Danfoss AK-SM800A
Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system.
-
Critical 9.9
Authenticated OS Command Injection in Danfoss AK-EM100
The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.
-
Critical 9.0
Reflected Cross-Site Scripting in Danfoss AK-EM100
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.
-
Critical 10.0
SQL Injection in Danfoss AK-EM100
The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.
-
Medium 5.3
Webreport disclosure to unauthorized actor in Danfoss AK-EM100
The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values.
-
High 7.7
Local File Inclusion in Danfoss AK-EM100
The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.
-
High 7.5
Cleartext credentials in Danfoss AK-EM100
The Danfoss AK-EM100 stores login credentials in cleartext.
-
Critical 9.0
Reflected Cross-Site Scripting in Danfoss AK-EM100
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.