Ic7 Marine
Monthly
Improper access control on the debug and engineering interfaces of Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 drive platforms lets attackers read and write internal device values and, more critically, upload and execute unsigned applications, EEPROM data, and firmware through exposed service and software-update mechanisms. Rated CVSS 4.0 9.3, the flaw effectively bypasses code-signing and grants full control over affected industrial drive controllers. There is no public exploit identified at time of analysis, but the missing authentication and firmware-overwrite capability make this a severe integrity and availability risk for operational technology environments.
Improper access control on the debug and engineering interfaces of Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 drive platforms lets attackers read and write internal device values and, more critically, upload and execute unsigned applications, EEPROM data, and firmware through exposed service and software-update mechanisms. Rated CVSS 4.0 9.3, the flaw effectively bypasses code-signing and grants full control over affected industrial drive controllers. There is no public exploit identified at time of analysis, but the missing authentication and firmware-overwrite capability make this a severe integrity and availability risk for operational technology environments.