nero22k/cve-2025-41450_pocPython proof of concept for CVE-2025-41450: derives the Danfoss AK-SM 800A code-of-the-day from device clock data and tests the getauth authentication bypass via /xml.cgi.
A Python proof of concept demonstrating a predictable code-of-the-day authentication mechanism exposed through the Danfoss system manager XML interface.
The vulnerability may allow a remote, unauthenticated actor to derive a daily authentication code from information exposed by the device and submit it through an alternative authentication path, bypassing the ordinary username/password process.
| Field | Details |
|---|---|
| CVE | CVE-2025-41450 |
| Vendor | Danfoss |
| Product | AK-SM 8xxA series (including AK-SM 800A) |
| Vulnerability | Improper authentication / authentication bypass |
| Affected software | Versions prior to 4.2, according to Danfoss |
| Remediation | Upgrade to an appropriate vendor-fixed release; Danfoss identifies 4.2 as fixing this CVE |
| Interface used by this PoC | HTTP(S) POST /xml.cgi |
| Dependencies | Python 3, standard library only |
The PoC follows four steps:
read_date_time to retrieve the controller's year, month and day.code_of_day() to obtain a five-digit candidate password.getauth with the candidate code and either eds_only="1" (default) or quantum_only="1" (--quantum).write_value and load_file and inspect returned errors as evidence of whether the authentication check was passed.