CVE-2026-15203
Received Received - Intake

Improper Access Control in Danfoss iC7 Series

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Danfoss

Description
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-15203
EUVD
EUVD-2026-66251

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
danfoss ic7-automation *
danfoss ic7-marine *
danfoss ic7-hybrid *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1191 The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper access control in debug and engineering interfaces of Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 devices. Attackers can exploit exposed service interfaces and software update mechanisms to gain unauthorized read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware.

Impact Analysis

This vulnerability allows attackers to manipulate device behavior, potentially causing operational disruptions, unauthorized access to sensitive data, or complete system compromise. It could lead to unauthorized control of connected systems, data breaches, or physical damage depending on the device's function.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data, lack of data integrity due to unsigned firmware/EEPROM uploads, and insufficient access controls. It may result in data breaches or unauthorized modifications violating regulatory requirements.

Mitigation Strategies

Immediately restrict network access to exposed debug and engineering interfaces. Disable or block unauthorized service interfaces and software update mechanisms. Ensure all firmware and EEPROM updates are signed and verified before installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart