CVE-2025-41451
HighCVSS 8.7Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
Risk Assessment
An authenticated attacker can execute arbitrary system commands, taking control of the device. This may disrupt refrigeration systems and compromise infrastructure security.
Recommendation
Update Danfoss AK-SM8xxA Series to version 4.3.1 or later. Restrict access to the administrative interface and enforce strong authentication.
Other vulnerabilities in Danfoss AK-SM8xxA Series
Original NVD description (English source)
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS