CVE-2026-15203criticalCWE-1191

CVE-2026-15203: critical vulnerability in Danfoss iC7-Automation SP

Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

Published

Follow this CVE+ Monitor iC7-Automation SP+ Monitor iC7-Hybrid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.5%
from disclosure to weapon
Published on NVDAug 26
victimsOct 12
Appeared in 2 incident(s) we investigated
Supermercados franceses (Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, Super U) · Intermarché, Coopérative U, E.Leclerc, Monoprix (France)
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
Danfoss · iC7-Automation SPDanfoss · iC7-HybridDanfoss · iC7-Marine