{"id":"CVE-2025-41451","title":"Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series","summary":"Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an att…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cvssSource":"cna","cwe":["CWE-77"],"vendor":"Danfoss","product":"AK-SM8xxA Series","affected":["ak-sm8xxa_series < 4.3.1"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-19T19:12:30.691978Z"},"exploitAvailable":true,"published":"2025-08-22","updated":"2026-10-19","sourceUpdated":"2026-10-19T19:12:52.159Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-41451","references":[{"url":"https://www.danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview"}],"tags":["cve.org","exploit-available"],"epss":0.04462,"epssPercentile":0.91389,"ingestedAt":"2026-10-19T19:38:06.459Z","slug":"CVE-2025-41451","body":"## Overview\n\nImproper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.\n\n## Affected\n\n- `ak-sm8xxa_series < 4.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":47.8,"likelihood":0.9,"exploitation":12,"ransomware":0},"changes":[]}