CVE-2023-25912: Webreport disclosure to unauthorized actor in Danfoss AK-EM100
The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25912?
CVE-2023-25912 is a vulnerability in the webreport generation feature of the Danfoss AK-EM100 device that allows an unauthorized actor to generate a web report and disclose sensitive information.
What is the severity of CVE-2023-25912?
The severity of CVE-2023-25912 is medium, with a severity value of 5.3.
How does CVE-2023-25912 affect the Danfoss AK-EM100 device?
CVE-2023-25912 affects the Danfoss AK-EM100 device by allowing unauthorized actors to generate web reports and expose sensitive information such as internal IP addresses, usernames, and internal device values.
What software versions of the Danfoss AK-EM100 are affected by CVE-2023-25912?
Software versions up to and excluding 2.2.0.12 of the Danfoss AK-EM100 firmware are affected by CVE-2023-25912.
How can I fix CVE-2023-25912?
To fix CVE-2023-25912, it is recommended to update the Danfoss AK-EM100 firmware to a version beyond 2.2.0.12.