CVE-2025-41451CWE-77command-injection

CVE-2025-41451

published August 22, 2025

CVSS
8.7
EPSS
3%
Percentile
87.6
In the wild
Unconfirmed
What it is

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.03072 · 87.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-08-22T07:15Z
References (2)
https://www.danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview · d7ff35af-cf88-454c-bab9-af60602f10f8https://github.com/msuiche/fromagegate · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 22 AUG 02:40Z
    Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series
    cvelistv5