Skip to main content
Danfoss

DSA-2026-08-01

Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

Advisory Information

Advisory ID: DSA-2026-08-01

  • CVE numbers and CVSS scores
    • CVE number: CVE-2026-15203
    • CVSS:9.3

Summary

Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 software expose debug interfaces by default, allowing unauthorized access to internal data, uploading unsigned applications, and modifying firmware.

Affected products and services

  • Danfoss iC7-Automation SP prior to version 2025.3.3
  • Danfoss iC7-Marine prior to version 2025.8.19
  • Danfoss iC7-Hybrid prior to version 2025.10.300845

Vulnerability description

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms.

Remediations

Mitigations

  • N/A

Credits (if opted in)

  • N/A

Other reference

https://assets.danfoss.com/software/latest/572932/ID543724747716-0201.zip
https://assets.danfoss.com/software/latest/595833/ID506542766960-0501.zip
https://assets.danfoss.com/software/latest/595835/ID506543688961-0601.zip

Update log

  • 18 September, 2026: Publication