PT-2025-34327 · Danfoss · Ak-Sm8Xxa

Published 2025-08-22 · Updated 2025-08-24 · CVE-2025-41451

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: Danfoss AK-SM8xxA Series versions prior to 4.3.1

Description: Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') exists in the software, potentially leading to post-authenticated remote code execution on an attacked system. The vulnerability resides in the handling of configuration fields used for alarm-to-mail functionality. A 'Command Injection' occurs when an attacker can insert arbitrary commands into a system's shell through manipulated input.

Recommendations: Update Danfoss AK-SM8xxA Series to version 4.3.1 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-41451

Affected Products

Ak-Sm8Xxa

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-41451 · Security Note
• https://twitter.com/SecAideInfo/status/1959559718659105206 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1958750072402854308 · Twitter Post
• https://t.me/cveNotify/133134 · Telegram Post
• https://twitter.com/CVEnew/status/1958746526072881603 · Twitter Post
• https://danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview · Note
• https://t.me/CVEtracker/30651 · Telegram Post