Danfoss Ak-em100 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Danfoss Ak-em100 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2023-22583 — CVSS 10.0 (critical): The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.
• CVE-2023-25911 — CVSS 9.9 (critical): The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application…
• CVE-2023-22585 — CVSS 9.0 (critical): The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.
• CVE-2023-22582 — CVSS 9.0 (critical): The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.
• CVE-2023-22586 — CVSS 7.7 (high): The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.
• CVE-2023-22584 — CVSS 7.5 (high): The Danfoss AK-EM100 stores login credentials in cleartext.
• CVE-2023-25912 — CVSS 5.3 (medium): The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive…