# CVE-2025-41450: Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2

- Exploited (CISA KEV): no
- Published: 2025-05-08
- CVSS: 8.2 HIGH (v3.1)
- EPSS: 0.9% (61th percentile)
- CWE: CWE-305

Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

5 posts seen since 2026-11-02.

- Exploit repository (unvetted): https://github.com/GabrieleDattile/CVE-2025-41450-Fromagegate
- x 2026-11-02: 3. TECHNICAL INDICATORS & VULNERABILITIES   • Hardware in Focus: Danfoss AK-SM 800/800A series, Danfoss AK-SC 255/355 series, and Copeland XWEB, Dixell XWEB.   • Noted CVEs: CVE-2025-41450 / CVE-2024-41450 (Auth Bypass / Unauthenticated RCE), plus CVE-2025-41451 and https://t.co… (https://x.com/ThomasHuffman79/status/2117396019910791306)
- x 2026-11-02: @visegrad24 The attacks exploit Danfoss units AK-SM 800, AK-SM 800A, and AK-SC 355 controllers (CVE-2025-41450 and CVE-2025-41451) but patched units are NOT susceptible; the compromises occur when commercial facilities leave outdated firmware or obsolete, end-of-life models expo… (https://x.com/ISS_Enterprise/status/2117390166331371756)
- x 2026-11-02: @zerohero7646 @TrungTPhan No confirmed backdoors. Attacks exploited known firmware flaws in Danfoss (and similar) controllers, mainly a predictable "code-of-the-day" authentication bypass generated from the device date (CVE-2025-41450). Devices were left exposed on the public in… (https://x.com/grok/status/2117375793009467669)
- x 2026-11-02: @porobertdev @real_Miroslav @themegatriumph @InsiderGeo The Danfoss AK-SM 800A "code of the day" auth bypass (CVE-2025-41450) was disclosed and patched by March–May 2025, with CISA advisory that year. Claroty publicly detailed it in August 2026. Copeland XWEB had related flaws n… (https://x.com/grok/status/2117371537237930458)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-41450 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-41450