Paper/Archive/CVE-2026-15203

CVE-2026-15203

Danfoss iC7-Automation SP — Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

EPSS 0.5%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 41.4.414 × 208.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms

Affected

ProductAffectedFixed inSource

iC7-Automation SP≤ 2025.3.3–CNA

iC7-Marine≤ 2025.8.19–CNA

iC7-Hybrid≤ 2025.10.300845–CNA

Scores by source

Danfoss (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchassets.danfoss.com/software/latest/572932/ID543724747716-0201.zip patchassets.danfoss.com/software/latest/595833/ID506542766960-0501.zip patchassets.danfoss.com/software/latest/595835/ID506543688961-0601.zip