CVE-2023-25914

HIGH

Danfoss AK-SM 800A Firmware < 3.3 - Authenticated Path Traversal via XML Interface

Title source: llm

Description

Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory

https://csirt.divd.nl/CVE-2023-25914

Third Party Advisory third-party-advisory

https://csirt.divd.nl/DIVD-2023-00025

Scores

CVSS v3 8.8

EPSS 0.0067

EPSS Percentile 47.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-22

Status published

Products (1)

danfoss/ak-sm_800a_firmware < 3.3

Published Aug 21, 2023

Tracked Since Feb 18, 2026