CVE-2025-41450
Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2
- Published
- May 8, 2025
- Updated
- Oct 19, 2026
- Assigning CNA
- Danfoss
- Evidence observed
- Nov 13, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:HLow · next 30 days
- Percentile
- 61.4%
- Model date
- Nov 6, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
Sources
- fromagegatePoC
PoC and detection toolkit for Danfoss AK-SM 8xxA CVE-2025-41450/-41451/-41452: code-of-the-day auth bypass, alarm-to-mail RCE, and nginx config injection, with Suricata/Sigma rules.
Python proof of concept for CVE-2025-41450: derives the Danfoss AK-SM 800A code-of-the-day from device clock data and tests the getauth authentication bypass via /xml.cgi.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.