Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: Danfoss Component: Ak-em100 Firmware Clear all filters
TI-2023-11165 CVE-2023-25911 · GHSA-r358-c7w3-46x5

Authenticated OS Command Injection in Danfoss AK-EM100

Priority MEDIUM 47

The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02218 Published 2023-06-11 Fixed in 2.2.0.12 CWE-77
TI-2023-08778 CVE-2023-22583 · GHSA-rw57-p6vv-42wg

SQL Injection in Danfoss AK-EM100

Priority MEDIUM 50

The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00755 Published 2023-06-11 Fixed in 2.2.0.12 CWE-89
TI-2023-08777 CVE-2023-22582 · GHSA-9926-q94j-c3rc

Reflected Cross-Site Scripting in Danfoss AK-EM100

Priority MEDIUM 42

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00598 Published 2023-06-11 Fixed in 2.2.0.12 CWE-79
TI-2023-08779 CVE-2023-22584 · GHSA-6xpq-789w-crhj

Cleartext credentials in Danfoss AK-EM100

Priority LOW 39

The Danfoss AK-EM100 stores login credentials in cleartext.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2023-06-11 Fixed in 2.2.0.12 CWE-312
TI-2023-08780 CVE-2023-22585 · GHSA-m336-3p9f-8r49

Reflected Cross-Site Scripting in Danfoss AK-EM100

Priority MEDIUM 42

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00598 Published 2023-06-11 Fixed in 2.2.0.12 CWE-79
TI-2023-08781 CVE-2023-22586 · GHSA-f3qm-vwjc-2pfv

Local File Inclusion in Danfoss AK-EM100

Priority LOW 35

The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00669 Published 2023-06-11 Fixed in 2.2.0.12 CWE-200
TI-2023-11166 CVE-2023-25912 · GHSA-p3xm-g7cx-5qfp

Webreport disclosure to unauthorized actor in Danfoss AK-EM100

Priority LOW 31

The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.006 Published 2023-06-11 No fix listed CWE-200