CVE-2023-22584

Executive Summary

CVE-2023-22584 describes a cleartext credential storage vulnerability in the Danfoss AK-EM100 — a building automation / refrigeration monitoring controller. An attacker with local file system access — or network access if the device exposes its configuration interface — can retrieve administrator and service account credentials in plaintext, enabling full device compromise, lateral movement into the building management network, and persistent unauthorized control of HVAC/refrigeration infrastructure. The affected product is End of Life (EOL); the vendor has no supported patch and recommends decommissioning all AK-EM100 units. The CVSS score of 7.5 reflects a high confidentiality and integrity impact with network-adjacent attack vector, though no public exploit code or in-the-wild exploitation has been confirmed at this time (EPSS 0.00453, 37.3rd percentile).

Technical Analysis

The NVD description provides minimal technical detail, stating only: "The Danfoss AK-EM100 stores login credentials in cleartext." Based on this vulnerability class (CWE-522 — Insufficiently Protected Credentials), the following analysis is provided at the vulnerability-class level; specific implementation details are not available from public sources.

The AK-EM100 is a building management controller used in refrigeration and HVAC monitoring systems. Like many embedded building automation devices, it likely maintains a local user database for authentication (web interface, maintenance console, or service access). Storing credentials in cleartext means that the plaintext password is written to persistent storage — typically a configuration file, embedded database, or non-volatile memory region — without hashing, encryption, or other cryptographic protection mechanisms.

The attack surface has two primary exposure vectors:

1. Local/Physical access: An attacker with physical access to the device (e.g., maintenance worker, disgruntled employee, or theft of the unit) can extract credentials directly from storage via debugging interfaces, removable media, or by reading the flash memory.

2. Network-facing access: If the AK-EM100 exposes a web-based configuration interface or remote management port, an attacker who can trigger a configuration backup, firmware dump, or file disclosure may retrieve the stored credentials. Many building automation devices expose unauthenticated or weakly-authenticated diagnostics endpoints that allow file retrieval.

The severity of this flaw is heightened because:

• Building automation credentials are often reused across a fleet of controllers from the same vendor — a single extracted credential pair may unlock multiple devices.
• The AK-EM100 may have credentials for upstream integration (e.g., BMS server, cloud monitoring gateways, or Danfoss-specific monitoring platforms), meaning the extracted credentials may provide a jump point into higher-value network segments.
• The device is End of Life, meaning it has likely been deployed for many years; its firmware likely lacks modern security controls like encrypted storage, secure boot, or code integrity verification, making remote exploitation of related flaws more feasible.

The CVSS vector, though not publicly specified, is consistent with a network-adjacent attack requiring low complexity, no privileges, and user interaction, with high confidentiality impact (credential disclosure) and high integrity/availability impact (full device takeover potential). The high attack complexity in the inferred vector reflects the fact that credential extraction typically requires either physical access or a secondary code execution/misconfiguration to reach the stored data.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE. The attack chain below is inferred strictly from the vulnerability class (cleartext credential storage) and the device's role in building automation. Specific implementation details are not available.

Step 1 — Reconnaissance / Target Identification

An attacker identifies AK-EM100 devices via network scanning (Shodan, masscan, or Nmap) using search indicators such as the device's default page title, port signatures, or vendor-specific MIB/SNMP identifiers. Building management networks often have weak segmentation, so the device may be reachable from the corporate LAN or directly from the internet if incorrectly exposed. The attacker gains knowledge of the device type and its authentication interface (web console, CLI, or SNMP).

Step 2 — Triggering the Vulnerability

The attacker must obtain the cleartext credential store. Attack vectors include:

• Network-based: If the device exposes a configuration backup or firmware download endpoint, the attacker retrieves the backup file. Cleartext credential storage means the backup file contains plaintext usernames and passwords, requiring no further decryption.
• Physical/local: The attacker gains physical access to the device and connects to debugging ports (UART, JTAG) or removes storage media to read the credential database directly.
• Secondary exploit: If a separate web vuln (e.g., path traversal, command injection) exists — not detailed in this CVE's description — the attacker may leverage it to read the configuration file remotely.

Step 3 — Payload / Execution at Vulnerability-Class Level

There is no injection payload required — the flaw itself does not involve code execution. Instead, the "paylooad" is the file access or physical extraction step. Once the credential store is retrieved, the attacker extracts plaintext passwords. As cleartext storage implies no hashing, no cracking is necessary.

Step 4 — Post-Exploitation Impact

The attacker authenticates to the AK-EM100 web console or management interface with the extracted credentials. With admin-level credentials, the attacker can:

• Change device settings (temperature setpoints, alarm thresholds), potentially causing operational disruption to refrigeration/HVAC infrastructure.
• Upload malicious firmware or configuration — leading to persistent backdoor access.
• Use the device as a pivot point to access the broader building management system (BMS) network, potentially compromising other controllers, the central BMS server, or the corporate network.

The business impact is especially severe for cold-chain/logistics facilities where refrigeration disruption can ruin inventory worth millions.

No public PoC available; attack chain is based on vulnerability class and device role.

Impact Assessment

Business Impact: The AK-EM100 is an embedded controller typically deployed in refrigeration monitoring for supermarkets, cold storage warehouses, food processing, and pharmaceutical logistics. Compromise can lead to:

• Operational disruption (CVSS impact sub-scores: H/H/H) — unauthorized modification of refrigeration setpoints can spoil inventory, violating food-safety regulations (HACCP) and causing direct financial loss.
• Data confidentiality loss — cleartext credentials for the controller may also be reused for other systems; the extracted credential store may include upstream integration credentials.
• Regulatory risk — in critical infrastructure contexts, a compromise may trigger mandatory incident reporting (e.g., EU NIS2, FDA, or local food-safety notification requirements).

Affected Systems: All Danfoss AK-EM100 units, as the product is EOL and no version-based distinction is reported. This affects primarily organizations in retail grocery, cold-chain logistics, pharma distribution, and industrial refrigeration.

Blast Radius: The credential disclosure itself is limited to one device, but the blast radius extends to any system that shares the extracted credentials. In deployments where the same admin password is rolled across a fleet of Danfoss controllers (a common operational pattern), one compromised device unlocks the entire fleet. Additionally, if the AK-EM100 communicates with a central BMS or cloud platform via hardcoded/reused credentials, the attacker may pivot beyond the OT network.

CVSS Score: 7.5 (High). Inferred vector suggests high confidentiality and integrity impact. The relatively low EPSS (0.00453) indicates that, as of publication, exploitation in the wild is considered unlikely; however, this is a risk-assessment metric that changes as knowledge of the flaw spreads within OT-targeting threat groups.

Detection Guidance

Sigma Rule

title: Danfoss AK-EM100 Cleartext Credential Access Attempt
status: experimental
description: Detects attempts to access or download configuration/credential files from Danfoss AK-EM100 devices.
author: vartersit.com
logsource:
  product: suricata
  category: http
detection:
  selection:
    http.method: *    # any method
    http.url|contains:
      - 'config'
      - 'backup'
      - 'download'
      - 'export'
      - 'settings'
      - 'credential'
      - 'passwd'
    http.hostname|contains: 'ak-em100'
  condition: selection
falsepositives:
  - Legitimate administrator configuration backups
level: medium
tags:
  - attack.t1393
  - attack.t1087
  - cve.2023.22584

YARA Rule

rule CVE_2023_22584_Danfoss_AKEM100_Cleartext_Creds {
    meta:
        author = "vartersit.com"
        date = "2024-01-15"
        description = "Detects credential stores/config files from Danfoss AK-EM100 containing cleartext passwords"
        cve = "CVE-2023-22584"
    strings:
        $device_marker = "AK-EM100"
        $user_marker = "user=" or $user_marker = "username=" or $user_marker = "admin"
        $pass_marker = "pass=" or $pass_marker = "password="
        $config_marker = "[config]" or $config_marker = "startup.cfg"
    condition:
        uint16(0) == 0x5A4D and $device_marker and any of them
        // or, for plain text captures:
        or ($device_marker and $user_marker and $pass_marker and filesize < 1MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-22584 - Danfoss AK-EM100 config download attempt"; \
  flow:to_server,established; \
  content:"GET"; http.method; \
  http.uri; content:"/config"; nocase; \
  http.uri; content:"backup"; nocase; \
  http.host; content:"ak-em100"; nocase; \
  without_name:false; \
  metadata: cve CVE-2023-22584; \
  sid:200382584; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5s
  [network where protocol == "http" and 
    destination.port == 80 or destination.port == 443 and
    url.path contains ("config", "backup", "export", "download")]
  [file where event.action == "file_download" and 
    file.name contains ("config", "backup", "*.cfg", "*.bin")]

Splunk SPL Query

index=proxy OR index=web 
| where match(url_path, "(?i)config|backup|export|download") 
| where like(lower(host), "%ak-em100%") 
| stats count by src_ip, dest_ip, url_path, status_code, _time 
| sort - _time 
| eval severity = case(count > 5, "high", count > 1, "medium", count == 1, "low") 
| table _time, src_ip, dest_ip, url_path, status_code, severity

Wazuh OSSEC Rule

<group name="building_automation,">
  <rule id="100225" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.type">http</field>
    <match>AK-EM100|ak-em100</match>
    <description>Danfoss AK-EM100 device accessed - possible credential disclosure attempt</description>
    <group>cve-2023-22584,</group>
  </rule>
  <rule id="100226" level="12">
    <if_sid>100225</if_sid>
    <field name="url">config|backup|export|download</field>
    <description>Danfoss AK-EM100 config/backup download attempt - potential cleartext credential exfiltration</description>
    <group>cve-2023-22584,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed).

The vendor reports that a patch exists, but no patch version, CVE resolution timeline, or firmware download link is publicly available. Given the product is EOL, patching may be nominal (e.g., a minor firmware update) but not independently verifiable.

1) Immediate Mitigations (within 24–72 hours):

• Decommission the device: Danfoss explicitly advises phasing out AK-EM100 units. Replace with a current, supported controller with encrypted credential storage (e.g., Danfoss AK-SM800 series or equivalent.
• Network isolation: If decommissioning is not immediately possible, place all AK-EM100 devices on an isolated VLAN with strict firewall rules. Block all inbound traffic from the corporate IT network and internet. Allow only outbound communication to the BMS server on specific ports.
• Credential rotation: Rotate ALL credentials that may be shared with AK-EM100 devices — including the admin password, service accounts, and any BMS/cloud integration credentials. Assume any credential stored on the device is compromised.
• Change device admin password immediately (if the device is still operational) to reduce exposure window.

2) Patch/Upgrade Steps:

• Contact Danfoss technical support to confirm the claimed patch availability and obtain the specific firmware version. Validate a checksum against a signed source.
• If a patch is obtained, test in a staging environment before production deployment. Verify the patch actually encrypts credential storage (do not trust vendor claims without independent verification, given patch confidence of 2/4).
• If no patch is obtainable: treat the device as permanently vulnerable and prioritize replacement.

3) Long-Term Hardening:

• Replace EOL devices: Maintain an asset registry of all building automation controllers with firmware status. Enforce a policy that EOL devices cannot remain on the network beyond a defined sunset date.
• Encrypted credential storage: For any new controllers, verify that credentials are stored with at least a strong one-way hash (e.g., bcrypt, scrypt) or encrypted at rest with hardware-backed keys.
• Credential hygiene: Implement a building-management-specific credential vault. Ensure that no credentials are shared between OT devices and IT systems. Use dedicated service accounts with least-privilege for each device.
• Network segmentation: Apply Purdue-model segmentation (Level 0–3 separation) for OT networks. Block direct device access from corporate LAN; require a jump-host with MFA for administrative access.
• Monitoring: Deploy the detection rules above in your SIEM/IDS to detect any attempt to access configuration/backup files on BMS devices.

References

1. NVD Entry — CVE-2023-22584: https://nvd.nist.gov/vuln/detail/CVE-2023-22584
2. Danfoss Product Page (AK-EM100 details, EOL status via vendor advisory): https://www.danfoss.com — search "AK-EM100"
3. CWE-522 — Insufficiently Protected Credentials: https://cwe.mitre.org/data/definitions/522.html
4. CISA Known Exploited Vulnerabilities (KEV) Catalog — CVE-2023-22584 is NOT listed, confirming no confirmed in-the-wild exploitation as of this report: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS CVE Database — EPSS score 0.00453 yields the 37.3rd percentile probability of exploitation within 30 days: https://www.first.org/epss/

Threat Actor Activity: No specific threat group campaigns attributed to this CVE as of the reporting date. Given the device's EOL status and the increasing attention of state-sponsored and financially-motivated groups toward building automation systems (e.g., APT28, Sandworm, and ransomware groups targeting OT), exploitation likelihood will rise as the vulnerability becomes more widely known in OT-focused communities. Monitor ICS-CERT alerts and Danfoss security advisories for updates.