Danfoss vulnerabilities
We track 4 vulnerabilities in Danfoss products across 7 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 26, 2026.
Latest Danfoss vulnerabilities
- 9.3 Critical severity
iC7-Automation SP: On-Chip Debug and Test Interface With Improper Access Control
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data an
- 8.7 High severity
AK-SM8xxA Series: Improper Neutralization of Special Elements used in a Command
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
- 8.8 High severity
AK-SM800A: Improper Limitation of a Pathname to a Restricted Directory
Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise.
- 7.5 High severity
AK-SM800A: Improper Authentication
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.