CVE-2023-25911

EUVD-2023-29799
The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
DIVDCNA
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
danfossak-em100_firmware
𝑥
< 2.2.0.12
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://csirt.divd.nl/CVE-2023-25911/
https://csirt.divd.nl/DIVD-2023-00021/
https://csirt.divd.nl/DIVD-2023-00021
https://divd.nl/cves/CVE-2023-25911