Danfoss iC7 CVE-2026-15203

Exploitation requires network or service-network reachability to the exposed debug/engineering service interfaces and software-update mechanism of an iC7-Automation SP, iC7-Marine, or iC7-Hybrid GR3 drive; per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no elevated privileges are needed once that interface is reachable. The concrete prerequisite is access to the exposed service interfaces / software update channel - the very interfaces the improper access control fails to protect. The main limiting factor is network exposure: CWE-1191 debug/engineering interfaces are commonly confined to a service or engineering network rather than routable production networks, so a properly segmented deployment sharply reduces reachability; verify with Danfoss whether these interfaces are network-exposed by default. A vulnerable variant/version must also be present (Automation SP, Marine, or Hybrid GR3).

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high impact to confidentiality, integrity, and availability of the drive and low impact to subsequent systems - a genuine critical-severity profile at 9.3. The strongest real-world signal here is the impact class: arbitrary unsigned firmware/application execution on an OT controller is effectively device takeover. That said, the AV:N rating is worth scrutiny - CWE-1191 debug/engineering interfaces are frequently local, adjacent, or physically-exposed rather than routable, so verify with Danfoss whether these service interfaces are exposed over the network in default deployments or only reachable on a service/engineering network. No EPSS score, KEV listing, or POC is provided, so exploitation probability cannot be quantified; treat this as a high-priority patch based on impact and unauthenticated access, while recognizing exploitation likely depends on the attacker first reaching the service network segment. No public exploit is identified at time of analysis, and there is no evidence of active exploitation.

An attacker who can reach a drive's exposed service or software-update interface - for example from a compromised engineering workstation or an inadequately segmented plant/vessel network - connects without authentication and reads or alters internal control values. They then upload an unsigned malicious application or firmware image, which the device executes because signature enforcement is bypassed, giving them persistent control over the drive's behavior. No POC is publicly available, but the low attack complexity and lack of authentication make weaponization straightforward once the interface is reachable.