CVE-2025-41451 — Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series

CVE-2025-41451

Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series PUBLISHED

Description (CNA)

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.

Affected (CNA)

Vendor / product	Versions
Danfoss / AK-SM8xxA Series	affected 0 before 4.3.1

CWE

CWE-77

References

https://www.danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/msuiche/fromagegate