CVE-2023-22586 Threat Intelligence Report

Executive Summary

CVE-2023-22586 is a Local File Inclusion (LFI) vulnerability in the Danfoss AK-EM100 web application interface. The flaw exists in the application's handling of a file parameter, which allows an unauthenticated remote attacker to read arbitrary local files from the device's filesystem. The AK-EM100 is an energy monitoring device used primarily in commercial refrigeration systems, and the affected product has been declared End-of-Life (EOL) by Danfoss. Successful exploitation can result in disclosure of sensitive configuration data, credentials, and other system files, potentially enabling further compromise of the device and the broader industrial control system (ICS) network it is connected to.

Technical Analysis

The vulnerability is classified as a Local File Inclusion (LFI) flaw within the web application component of the Danfoss AK-EM100 device. Based on the NVD description, the flaw exists in the application's handling of the file parameter. LFI vulnerabilities of this nature typically arise when a web application dynamically includes or reads files based on user-supplied input without adequate sanitization or validation of the file path. This may occur in scenarios such as template loading, language file selection, or content rendering, where application developers pass user-controlled parameters directly to file access functions.

In the case of the AK-EM100, the application accepts a file parameter that references a local file on the device. An attacker can manipulate this parameter by injecting path traversal sequences (e.g., ../../) to escape the intended directory root and access arbitrary files on the device's filesystem. Common targets in such devices include:

• Configuration files containing credentials, API keys, or communication parameters
• /etc/passwd or similar OS-level files revealing user accounts
• Application source code that may reveal additional attack surface or hardcoded secrets
• Log files containing historical activity or network information

The attack vector is network-based (AV:N), meaning the vulnerability can be exploited remotely over the network without requiring physical access. The attack complexity is considered high (AC:H) due to potential mitigating factors such as need for specific knowledge of file paths, possible authentication requirements for certain access, or other conditions that may complicate reliable exploitation. Notably, the CVSS vector indicates that exploitation does not require user interaction or special privileges (PR:N, UI:N).

The AK-EM100 is an energy meter with web-based management capabilities, designed to monitor power consumption in commercial and industrial settings. Because this device is part of the operational technology (OT) environment in refrigeration and HVAC systems, its compromise may provide an entry point for lateral movement into more critical infrastructure.

It is important to note that the NVD entry does not specify the exact software versions affected, the underlying operating system, nor the specific application framework used. Insufficient technical detail is available regarding whether the LFI is PHP-based, ASP-based, or implemented in another language. The lack of a CWE indicator in the available metadata further limits precise classification, though the LFI pattern most commonly aligns with CWE-98.

Exploitation Scenarios

Note: No public PoC or exploit code is available for this vulnerability. The attack chain described below is inferred from the vulnerability class (Local File Inclusion) and the context of an embedded industrial device with a web UI.

Step 1: Reconnaissance / Target Identification

Attackers would typically identify AK-EM100 devices using network scanning techniques. The devices may listen on default ports used for web management (common for embedded web UIs, typically port 80 or 443). Shodan and similar search engines may reveal exposed devices via HTTP banners or page titles containing "Danfoss" or "AK-EM100". Given the device's role in commercial cooling installations, targets are likely to be business premises such as supermarkets, cold storage facilities, or industrial food processing plants. Attackers may also target the device as a foothold for broader network attacks against the OT segment.

Step 2: Triggering the Flaw Class

The attacker sends an HTTP request to the vulnerable web application, manipulating the file parameter to directory traversal. Given that the NVD description states "the file parameter" is vulnerable, the attack likely involves a URL path or query parameter named file. The attacker would modify the value from its intended legitimate use (e.g., file=report.html or file=page.php) to a traversal sequence such as:

• ../../../../etc/passwd
• ../../../../etc/shadow
• ../../../../config/config.ini

The exact application behavior depends on the filesystem paths and application logic, which are not specified in the available data. Since no authentication requirements are mentioned in the CVSS vector (PR:N), the request can likely be sent without prior login to the web application.

Step 3: Payload / Execution Method

At the vulnerability-class level, the payload is simply the path traversal string embedded in the file parameter, and the response body contains the contents of the requested file. The attacker may need to URL-encode the traversal characters (..%2F) to bypass basic input filtering or firewalls. Although limited to file reading (no file inclusion into executing code is confirmed), this LFI may—depending on the application architecture—potentially be chained with other attacks if the device's web app also executes included files.

Step 4: Post-Exploitation Impact

Upon successful file disclosure, the attacker could obtain:

1. Credentials and Secrets: Wi-Fi credentials, Modbus/TCP passwords, SNMP community strings, or API keys stored in configuration files.
2. Network Intelligence: Details about the local IP addressing, gateway configurations, and connection settings to building management systems (BMS) or SCADA controllers.
3. Application Source Code: PHP or other scripting source code exposed by the LFI may reveal additional endpoints, hardcoded backdoor credentials, or other logic flaws.
4. OS-Level Information: User accounts, system services, and running processes that aid further exploitation of the device.

If the device is a foothold on the corporate or OT network, attackers could pivot to other systems, deploy persistence within the device's firmware (since it is EOL and unpatched), or use the compromised device to disrupt energy monitoring in target facilities.

Impact Assessment

The CVSS score of 7.7 (High severity) reflects a significant confidentiality and integrity impact with a low availability impact. The vector details indicate:

• CVSS Base: 7.7
• Attack Vector: Network (AV:N) — Remotely exploitable without physical access.
• Attack Complexity: High (AC:H) — Attacker must overcome situational challenges such as guessing file paths or bypassing protective mechanisms.
• Privileges Required: None (PR:N) — No authentication needed.
• User Interaction: None (UI:N) — No user action required.
• Confidentiality: High (C:H) — Full file system disclosure is possible.
• Integrity: High (I:H) — May enable modification of files if further application logic allows.
• Availability: Low (A:L) — Impact on uptime is likely limited.

Business Impact

The AK-EM100 is deployed in commercial refrigeration and HVAC systems. Potential business impacts include:

• Intellectual Property Theft: Facility operational configs, energy usage patterns, and proprietary system settings.
• Operational Disruption: An attacker with access to device configurations could tamper with energy monitoring, causing inaccurate readings, incorrect billing data, or undetected operational anomalies.
• Compliance Violations: Loss of credential material or customer data may trigger breach notification requirements.
• ICS Network Compromise: As an entry point to the OT network, the device could be part of a larger campaign targeting critical infrastructure.

Blast Radius

Any actor with network reachability to the device's web interface is in scope. Because the device is EOL, devices remain permanently vulnerable. The ambiguity around authentication means that even limited exposure may be sufficient. Since no patch exists and the only remediation is device replacement, the vulnerable population will gradually shrink only as devices are physically retired.

Detection Guidance

Sigma Rule

Detection of path traversal in file parameter requests directed to AK-EM100 endpoints.

title: Danfoss AK-EM100 Local File Inclusion Attempt
id: 7d9f5fef-8a3a-4b3e-9e1d-2c9b0c77e1a9
status: experimental
description: Detects path traversal attempts in the file parameter used by the Danfoss AK-EM100 web application.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22586
author: ValtersIT Threat Intel Team
date: 2025/03/10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-uri-query|contains:
            - "file=../"
            - "file=..%2f"
            - "file=%2e%2e%2f"
            - "file=....//"
    condition: selection
level: high
falsepositives:
    - Legitimate requests that include traversals by design (rare)
fields:
    - clientip
    - cs-host
    - cs-uri-stem
    - cs-uri-query
    - sc-status

YARA Rule

Detection of payload patterns in request logs or PCAP-extracted HTTP URIs.

rule Danfoss_AKEM100_LFI_Traversal
{
    meta:
        author = "ValtersIT Threat Intel Team"
        description = "Detects path traversal patterns targeting the file param of Danfoss AK-EM100"
        cve = "CVE-2023-22586"
        date = "2025-03-10"
        severity = "high"
    strings:
        $s1 = "file=..%2f" ascii nocase
        $s2 = "file=..%252f" ascii nocase
        $s3 = "file=....//" ascii nocase
        $s4 = "file=..%2F" ascii nocase
        $s5 = "file=..%5c" ascii nocase
        $s6 = "file=..././" ascii nocase
        $s7 = "file=%2e%2e%2f" ascii nocase
        $s8 = "/etc/passwd" ascii nocase
        $s9 = "boot.ini" ascii nocase
        $s10 = "web.config" ascii nocase
    condition:
        uint16(0) == 0x0a0d or uint16(0) == 0x0d0a or filesize < 10KB
        and any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)
        and (any of ($s8, $s9, $s10) or any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7))
}

Suricata IDS Rule

Network-level detection of HTTP requests exploiting the LFI parameter.

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Danfoss AK-EM100 LFI - Traversal in file parameter (CVE-2023-22586)";
    flow:to_server,established;
    http.uri;
    content:"file="; nocase; http_uri;
    content:"../"; urilen:>20; distance:0; http_uri;
    pore:"/file=[^&]*?(?:\.\.\/|\.\.%2f|%2e%2e%2f|\.\.%255c)/Ui";
    classtype:attempted-recon;
    reference:cve,2023-22586;
    sid:20250310;
    rev:1;
)

Alternative rule for TOR and IPv6 environments:

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Danfoss AK-EM100 LFI - /etc/passwd disclosure attempt";
    flow:to_server,established;
    http.uri;
    content:"file="; nocase; http_uri;
    content:"/etc/passwd"; nocase; http_uri;
    classtype:attempted-admin;
    reference:cve,2023-22586;
    sid:20250311;
    rev:1;
)

Elastic Detection

EQL rule for detecting web requests containing file traversal patterns.

any where event.category == "web" and process.name == "httpd" and
  url.path like~ "*" and
  url.query like~ "*file=*" and (
    url.query like~ "*../*" or
    url.query like~ "*..%2f*" or
    url.query like~ "*%2e%2e%2f*" or
    url.query like~ "*..%5c*"
  ) and not source.ip in ("127.0.0.1", "::1")

Splunk SPL Query

Query for IIS/Apache access logs capturing traversal attempts.

index=web sourcetype=access_combined
| where like(uri_query, "%file=..%") OR like(uri_query, "%file=..%2f%") OR like(uri_query, "%file=.%2e%2f%")
| eval attack="LFI Traversal", cve="CVE-2023-22586"
| table _time, src_ip, dest_host, uri_path, uri_query, http_method, status
| sort - _time

Wazuh OSSEC Rule

XML rule for Wazuh to alert on LFI attempts.

<group name="web,attack,lfi,">
  <rule id="202386" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.\..*file=</field>
    <description>Danfoss AK-EM100 CVE-2023-22586: LFI traversal in file param</description>
    <group>web_attack,lfi,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2023-22586</info>
  </rule>
  <rule id="202387" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">file=.*\/etc\/passwd</field>
    <description>Danfoss AK-EM100 CVE-2023-22586: Attempt to read /etc/passwd</description>
    <group>web_attack,lfi,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2023-22586</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 1/4 — PARTIAL. No official patch exists. Danfoss has not released a firmware update to address this vulnerability. The only vendor-provided guidance is that the AK-EM100 is End-of-Life and devices should be phased out and replaced.

Immediate Mitigations

1. Network Segmentation: Place AK-EM100 devices on isolated network segments. Use VLANs or firewalls to prevent direct internet exposure and restrict access to the web interface to trusted administrative hosts only.
2. Access Control: Implement strict firewall rules allowing only authorized IP addresses to reach ports used by the web interface. Disable remote management if it is not essential to operations.
3. Web Application Firewall (WAF): Deploy a WAF in front of the device to filter out path traversal payloads in query parameters. Add custom rules to block file= parameters containing traversal sequences.
4. Monitoring: Enable logging on network devices and web servers to monitor for unexpected requests to AK-EM100 web interfaces. Correlate such activity with the Sigma/Suricata rules provided above.
5. Disable Features: If the web interface is not actively used for management, disable it entirely via local configuration if possible. The device may still allow access through serial ports or other local interfaces.

Patch/Upgrade Steps

1. Upgrade Path: No software update path exists. The device is EOL.
2. Replacement Plan: Collaborate with Danfoss or an authorized distributor to identify a modern replacement device that is still under support. Plan the migration of configuration and monitoring data from the AK-EM100 to the new device.
3. Remove from Network: Once replacement devices are operational, decommission AK-EM100 units and remove them from the network entirely.

Long-Term Hardening

1. Asset Inventory: Maintain an inventory of all OT devices, including model, firmware, and EOL status. Flag any EOL device with a risk score and prioritize replacement.
2. Vendor Management: Ensure procurement policies require that purchased devices have a minimum support lifecycle commitment of 5 years.
3. Conduct OT Risk Assessments: Regularly review the security posture of the entire OT environment. Include AK-EM100 or similar devices in penetration testing and vulnerability scanning scopes.
4. Zero-Trust Architecture: Implement a zero-trust network model where all devices—including OT components—must authenticate and be authorized for each communication flow.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2023-22586 Official CVE record with description and CVSS metrics (NVD).

2. Danfoss Advisory — Danfoss AK-EM100 End-of-Life Product Notice (available through Danfoss customer support portal) The vendor announcement stating the product is EOL and recommending phase-out.

3. CVEDetails — https://www.cvedetails.com/cve/CVE-2023-22586/ Aggregated vulnerability data.

4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog CVE-2023-22586 is not listed, indicating no known exploit-in-the-wild as of the latest catalog update.

5. FIRST EPSS — https://www.first.org/epss/ EPSS score of 0.00669 (48.6 percentile) is available, indicating moderate probability of exploitation in the wild relative to all known CVEs.

Threat Actor Campaigns: No known threat actor campaigns specifically targeting this CVE have been publicly documented. Given the low EPSS percentile and lack of CISA KEV listing, active exploitation in the wild is considered limited at this time. However, embedded device CVEs often see delayed exploitation after researchers or adversaries discover them through reverse engineering of the vendor's larger product line. Organizations using AK-EM100 devices should not assume that the low EPSS mitigates the need for remediation, especially given the permanent absence of a patch.