CVE-2023-25914

Published: Aug 21, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise.

Affected (1)

Products: Danfoss: Ak Sm 800a Firmware

Danfoss

1 product

Ak Sm 800a Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Danfoss Ak Sm 800a Firmware	Up to 3.3

Running on/with	Platform Versions
Danfoss Ak Sm 800a	All versions

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

https://csirt.divd.nl/CVE-2023-25914

Source: csirt@divd.nl

Third Party Advisory

https://csirt.divd.nl/DIVD-2023-00025

Source: csirt@divd.nl

Third Party Advisory

https://csirt.divd.nl/CVE-2023-25914

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://csirt.divd.nl/DIVD-2023-00025

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.