Ak-Em100 Firmware Security Vulnerabilities

CVE-2023-22582

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.

CVE-2023-22583

The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.

CVE-2023-22584

The Danfoss AK-EM100 stores login credentials in cleartext.

CVE-2023-22585

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.

CVE-2023-22586

The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.

CVE-2023-25911

The Danfoss AK-EM100 web applications allow for OS command injection through the web application parameters.

CVE-2023-25912

The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values.