Ak Em100 Firmware
CVE-2023-22583
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.
AnalysisAI
The Danfoss AK-EM100 web forms allow for SQL injection in the login forms. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. The Danfoss AK-EM100 web forms allow for SQL injection in the login forms. Affected products include: Danfoss Ak-Em100 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
More in Ak Em100 Firmware
View allThe Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web ap
The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter. Rated high severity (CVSS 7.
The Danfoss AK-EM100 stores login credentials in cleartext. Rated high severity (CVSS 7.5), this vulnerability is remote
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter. Rated medium seve
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this v
The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that disc
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today