CVE-2023-25913 Authentication Bypass in Danfoss AK-SM800A
An attacker can bypass authentication to generate web reports disclosing sensitive internal information like IP addresses and usernames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25913?
CVE-2023-25913 is a high-severity authentication bypass vulnerability in Danfoss AK-SM800A, published on 21 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.
Which versions are affected by CVE-2023-25913?
It affects 1 product.
Products include Danfoss Ak-Sm 800a Firmware.
How do I fix CVE-2023-25913?
No fix has been published for CVE-2023-25913 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-25913 being exploited?
There is no known exploitation of CVE-2023-25913 in the wild and no public exploit code.
Other vulnerabilities in Danfoss AK-SM800A
Sources
Also known as GHSA-h6fm-wmvq-ppw8.