CVE-2026-15203: CWE-1191 On-Chip debug and test interface with improper access control in Danfoss iC7-Automation SP

The vulnerability CVE-2026-15203 affects Danfoss iC7-Automation SP and related products by exposing on-chip debug and engineering interfaces without proper access control. This flaw permits unauthorized attackers to gain read and write access to internal device values, upload and execute unsigned applications, and modify EEPROM data and firmware via exposed service interfaces and software update mechanisms. The vulnerability is classified under CWE-1191 (Improper Access Control). The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, with high impact on confidentiality, integrity, and availability. The vendor has not provided a remediation level or patch information as of the publication date.

Successful exploitation could allow attackers to fully compromise the affected devices by reading and modifying internal values, executing arbitrary unsigned code, and altering firmware and EEPROM data. This could lead to complete device takeover, disruption of device functionality, and potential compromise of systems relying on these devices. The high CVSS score reflects the critical nature of this vulnerability with significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices and monitor for unauthorized access attempts. Follow any vendor recommendations once available.