CVE-2025-41452

MediumCVSS 6.8

Published: 22/08/2025(UTC)Updated: 19/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.71%

53th percentile - higher than 53% of all known CVEs

Summary

A post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1 could allow for a denial of service attack induced by improper handling of exceptional conditions.

Risk Assessment

Disruption of the control system and unavailability of the web interface is possible, potentially affecting operational processes dependent on the device.

Recommendation

Update Danfoss AK-SM8xxA Series to version 4.3.1 or later and restrict web interface access to trusted networks and users.

Other vulnerabilities in Danfoss AK-SM8xxA Series

CVE-2025-41451High
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.

Original NVD description (English source)

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions

Vulnerability data from NVD (NIST) · CISA KEV · EPSS