Search
Find a vulnerability
Search criteria
2 vulnerabilities found for iC7-Automation SP by Danfoss
CVE-2026-15203 (GCVE-0-2026-15203)
Vulnerability from nvd – Published: 2026-08-26 05:36 – Updated: 2026-08-26 14:58
VLAI
EPSS
VEX
Title
Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software
Summary
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 14:55 UTC
CWE
- CWE-1191 - On-Chip debug and test interface with improper access control
Assigner
References
3 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Danfoss | iC7-Automation SP |
Affected:
0 , ≤ 2025.3.3
(custom)
|
|
| Danfoss | iC7-Marine |
Affected:
0 , ≤ 2025.8.19
(custom)
|
|
| Danfoss | iC7-Hybrid |
Affected:
0 , ≤ 2025.10.300845
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15203",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T14:55:58.163499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:58:01.137Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iC7-Automation SP",
"vendor": "Danfoss",
"versions": [
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iC7-Marine",
"vendor": "Danfoss",
"versions": [
{
"lessThanOrEqual": "2025.8.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iC7-Hybrid",
"vendor": "Danfoss",
"versions": [
{
"lessThanOrEqual": "2025.10.300845",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eImproper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1191",
"description": "CWE-1191 On-Chip debug and test interface with improper access control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T05:36:02.006Z",
"orgId": "d7ff35af-cf88-454c-bab9-af60602f10f8",
"shortName": "Danfoss"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip"
},
{
"tags": [
"patch"
],
"url": "https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip"
},
{
"tags": [
"patch"
],
"url": "https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cul\u003e\u003cli\u003eiC7-Automation SP:\u0026nbsp;\u003ca href=\"https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip\" title=\"https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip\"\u003ehttps://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip\u003c/a\u003e\u0026nbsp;(Release\u0026nbsp;2026.2.5-26A)\u003c/li\u003e\u003cli\u003eiC7-Marine:\u0026nbsp;\u003ca href=\"https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip\" title=\"https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip\"\u003ehttps://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip\u003c/a\u003e\u0026nbsp;(Release\u0026nbsp;2026.6.30-GR4.4)\u003c/li\u003e\u003cli\u003eiC7-Hybrid:\u0026nbsp;\u003ca href=\"https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip\" title=\"https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip\"\u003ehttps://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip\u003c/a\u003e\u0026nbsp;(Release\u0026nbsp;2026.7.2-GR4.5)\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
}
],
"value": "* iC7-Automation SP:\u00a0 https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip \u00a0(Release\u00a02026.2.5-26A)\n * iC7-Marine:\u00a0 https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip \u00a0(Release\u00a02026.6.30-GR4.4)\n * iC7-Hybrid:\u00a0 https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip \u00a0(Release\u00a02026.7.2-GR4.5)"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "d7ff35af-cf88-454c-bab9-af60602f10f8",
"assignerShortName": "Danfoss",
"cveId": "CVE-2026-15203",
"datePublished": "2026-08-26T05:36:02.006Z",
"dateReserved": "2026-07-09T06:41:49.174Z",
"dateUpdated": "2026-08-26T14:58:01.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15203 (GCVE-0-2026-15203)
Vulnerability from cvelistv5 – Published: 2026-08-26 05:36 – Updated: 2026-08-26 14:58
VLAI
EPSS
VEX
Title
Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software
Summary
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 14:55 UTC
CWE
- CWE-1191 - On-Chip debug and test interface with improper access control
Assigner
References
3 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Danfoss | iC7-Automation SP |
Affected:
0 , ≤ 2025.3.3
(custom)
|
|
| Danfoss | iC7-Marine |
Affected:
0 , ≤ 2025.8.19
(custom)
|
|
| Danfoss | iC7-Hybrid |
Affected:
0 , ≤ 2025.10.300845
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15203",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T14:55:58.163499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:58:01.137Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iC7-Automation SP",
"vendor": "Danfoss",
"versions": [
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iC7-Marine",
"vendor": "Danfoss",
"versions": [
{
"lessThanOrEqual": "2025.8.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iC7-Hybrid",
"vendor": "Danfoss",
"versions": [
{
"lessThanOrEqual": "2025.10.300845",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eImproper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1191",
"description": "CWE-1191 On-Chip debug and test interface with improper access control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T05:36:02.006Z",
"orgId": "d7ff35af-cf88-454c-bab9-af60602f10f8",
"shortName": "Danfoss"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip"
},
{
"tags": [
"patch"
],
"url": "https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip"
},
{
"tags": [
"patch"
],
"url": "https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cul\u003e\u003cli\u003eiC7-Automation SP:\u0026nbsp;\u003ca href=\"https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip\" title=\"https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip\"\u003ehttps://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip\u003c/a\u003e\u0026nbsp;(Release\u0026nbsp;2026.2.5-26A)\u003c/li\u003e\u003cli\u003eiC7-Marine:\u0026nbsp;\u003ca href=\"https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip\" title=\"https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip\"\u003ehttps://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip\u003c/a\u003e\u0026nbsp;(Release\u0026nbsp;2026.6.30-GR4.4)\u003c/li\u003e\u003cli\u003eiC7-Hybrid:\u0026nbsp;\u003ca href=\"https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip\" title=\"https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip\"\u003ehttps://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip\u003c/a\u003e\u0026nbsp;(Release\u0026nbsp;2026.7.2-GR4.5)\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
}
],
"value": "* iC7-Automation SP:\u00a0 https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip \u00a0(Release\u00a02026.2.5-26A)\n * iC7-Marine:\u00a0 https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip \u00a0(Release\u00a02026.6.30-GR4.4)\n * iC7-Hybrid:\u00a0 https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip \u00a0(Release\u00a02026.7.2-GR4.5)"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "d7ff35af-cf88-454c-bab9-af60602f10f8",
"assignerShortName": "Danfoss",
"cveId": "CVE-2026-15203",
"datePublished": "2026-08-26T05:36:02.006Z",
"dateReserved": "2026-07-09T06:41:49.174Z",
"dateUpdated": "2026-08-26T14:58:01.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}