Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
5 vulnerabilities
CVE-2026-75937 (GCVE-0-2026-75937)
Vulnerability from cvelistv5 – Published: 2026-10-02 20:33 – Updated: 2026-10-02 20:33
VLAI
EPSS
VEX
Title
OS Command Injection in Digi Accelerated Linux (DAL OS)
Summary
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Severity
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.digi.com/resources/security | mitigationvendor-advisory |
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digi International | IX Family |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | EX Family |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | TX Family |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | Connect IT Family |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | AnywhereUSB Plus Family |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | Connect EZ Family |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | XBee Hive Gateway |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | XBee Hive Border Router for Wi-SUN |
Affected:
21.8.24.139 , ≤ 26.7.90.14
(custom)
|
|
| Digi International | Digi 54xx Family |
Affected:
0 , ≤ 21.8.24.139
(custom)
|
|
| Digi International | Digi 63xx Family |
Affected:
21.8.24.139 , ≤ 22.5.50.66
(custom)
|
|
| Digi International | Digi IX14 |
Affected:
21.8.24.139 , ≤ 22.5.50.62
(custom)
|
|
| Digi International | Digi LR54 Family |
Affected:
21.8.24.139 , ≤ 23.12.1.56
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IX Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TX Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Connect IT Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AnywhereUSB Plus Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Connect EZ Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XBee Hive Gateway",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XBee Hive Border Router for Wi-SUN",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "26.7.90.14",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi 54xx Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "21.8.24.139",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi 63xx Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "22.5.50.66",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi IX14",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "22.5.50.62",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi LR54 Family",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "23.12.1.56",
"status": "affected",
"version": "21.8.24.139",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u7f8e\u56e2\u4f17\u5305\u9a91\u624b:\u952e\u76d8\u624b\u6b27\u591a\u514b"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u0026nbsp;Disable the web server when not configuring the device."
}
],
"value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u00a0Disable the web server when not configuring the device."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T20:33:56.823Z",
"orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"shortName": "Digi"
},
"references": [
{
"tags": [
"mitigation",
"vendor-advisory"
],
"url": "https://www.digi.com/resources/security"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in Digi Accelerated Linux (DAL OS)",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"assignerShortName": "Digi",
"cveId": "CVE-2026-75937",
"datePublished": "2026-10-02T20:33:56.823Z",
"dateReserved": "2026-08-18T15:53:39.284Z",
"dateUpdated": "2026-10-02T20:33:56.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12948 (GCVE-0-2026-12948)
Vulnerability from cvelistv5 – Published: 2026-07-07 14:32 – Updated: 2026-07-13 16:19
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting (XSS)
Summary
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-07 14:56 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digi International | Digi PortServer TS |
Affected:
82000747_V1 , ≤ 82000747_AB
(custom)
|
|
| Digi International | Digi One SP |
Affected:
82000774_Z , ≤ 82000774_AB
(custom)
|
|
| Digi International | Digi One SP IA |
Affected:
82000774_Z , ≤ 82000774_AB
(custom)
|
|
| Digi International | Digi One IA |
Affected:
82000774_Z , ≤ 82000774_AB
(custom)
|
Date Public
2026-07-07 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12948",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-07T14:56:16.795819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T14:56:24.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Digi PortServer TS",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000747_AB",
"status": "affected",
"version": "82000747_V1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi One SP",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000774_AB",
"status": "affected",
"version": "82000774_Z",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi One SP IA",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000774_AB",
"status": "affected",
"version": "82000774_Z",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi One IA",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000774_AB",
"status": "affected",
"version": "82000774_Z",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-07-07T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79)."
}
],
"value": "A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T16:19:13.748Z",
"orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"shortName": "Digi"
},
"references": [
{
"url": "https://www.digi.com/resources/security"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stored Cross-Site Scripting (XSS)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"assignerShortName": "Digi",
"cveId": "CVE-2026-12948",
"datePublished": "2026-07-07T14:32:43.977Z",
"dateReserved": "2026-06-22T20:33:02.985Z",
"dateUpdated": "2026-07-13T16:19:13.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12352 (GCVE-0-2026-12352)
Vulnerability from cvelistv5 – Published: 2026-07-07 14:31 – Updated: 2026-07-13 16:21
VLAI
EPSS
VEX
Title
Incorrect Authorization
Summary
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-07 14:56 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.digi.com/resources/security | mitigationvendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digi International | PortServer TS 1/2/4 |
Affected:
82000747_V1 , ≤ 82000747_AB
(custom)
|
|
| Digi International | Digi One SP / SP IA / IA |
Affected:
82000774_Z , ≤ 82000774_AB
(custom)
|
Date Public
2026-07-07 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-07T14:56:42.626683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T14:56:48.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PortServer TS 1/2/4",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000747_AB",
"status": "affected",
"version": "82000747_V1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Digi One SP / SP IA / IA",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000774_AB",
"status": "affected",
"version": "82000774_Z",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-07-07T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device."
}
],
"value": "This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T16:21:10.700Z",
"orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"shortName": "Digi"
},
"references": [
{
"tags": [
"mitigation",
"vendor-advisory"
],
"url": "https://www.digi.com/resources/security"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect Authorization",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"assignerShortName": "Digi",
"cveId": "CVE-2026-12352",
"datePublished": "2026-07-07T14:31:08.550Z",
"dateReserved": "2026-06-15T21:08:54.168Z",
"dateUpdated": "2026-07-13T16:21:10.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13319 (GCVE-0-2025-13319)
Vulnerability from cvelistv5 – Published: 2025-11-17 16:37 – Updated: 2025-11-17 16:46
VLAI
EPSS
VEX
Title
Authenticated SQL injection in API - Digi On-Prem Manager
Summary
An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.
The API is not enabled by default, and a valid API token is required to perform the attack.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-17 16:46 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://dom.nettec.no/security-advisories/DOM-25-001/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nettec AS | Digi On-Prem Manager |
Affected:
24.12.5 , < 25.08.5
(custom)
|
Date Public
2025-11-17 15:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13319",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-17T16:46:16.389834Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-17T16:46:47.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Digi On-Prem Manager",
"vendor": "Nettec AS",
"versions": [
{
"lessThan": "25.08.5",
"status": "affected",
"version": "24.12.5",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-11-17T15:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.\u003c/p\u003e\u003cp\u003eThe API is not enabled by default, and a valid API token is required to perform the attack.\u003c/p\u003e"
}
],
"value": "An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.\n\nThe API is not enabled by default, and a valid API token is required to perform the attack."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-17T16:39:45.998Z",
"orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"shortName": "Digi"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://dom.nettec.no/security-advisories/DOM-25-001/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2025-11-14T16:30:00.000Z",
"value": "Vulnerability discovered"
},
{
"lang": "en",
"time": "2025-11-17T15:30:00.000Z",
"value": "Fixed version released"
}
],
"title": "Authenticated SQL injection in API - Digi On-Prem Manager",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"assignerShortName": "Digi",
"cveId": "CVE-2025-13319",
"datePublished": "2025-11-17T16:37:40.377Z",
"dateReserved": "2025-11-17T15:24:52.019Z",
"dateUpdated": "2025-11-17T16:46:47.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3659 (GCVE-0-2025-3659)
Vulnerability from cvelistv5 – Published: 2025-05-12 20:40 – Updated: 2025-05-12 22:06
VLAI
EPSS
VEX
Title
Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP
Summary
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
* Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022
* Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020
* Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-12 21:43 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digi International | Digi PortServer TS |
Affected:
0 , ≤ 82000747_AA
(custom)
|
|
| Digi International | Digi One SP/Digi One SP IA/Digi One IA |
Affected:
0 , ≤ 82000774_Z
(custom)
|
|
| Digi International | Digi One IAP |
Affected:
0 , ≤ 82000770 Z
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-12T21:43:33.232090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-12T22:06:36.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Digi PortServer TS",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000747_AA",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Digi One SP/Digi One SP IA/Digi One IA",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000774_Z",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Digi One IAP",
"vendor": "Digi International",
"versions": [
{
"lessThanOrEqual": "82000770 Z",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper authentication handling was identified in a set of HTTP POST requests affecting the following product families: \u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eDigi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eDigi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eDigi One IAP \u2013 prior to and including 82000770 Z, build date 10/19/2020\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eA specially crafted POST request to the device\u2019s web interface may allow an unauthenticated attacker to modify configuration settings.\u003c/p\u003e"
}
],
"value": "Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: \n\n * Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022\n\n\n * Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020\n\n\n * Digi One IAP \u2013 prior to and including 82000770 Z, build date 10/19/2020\n\n\n\n\nA specially crafted POST request to the device\u2019s web interface may allow an unauthenticated attacker to modify configuration settings."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-12T20:40:03.567Z",
"orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"shortName": "Digi"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://hub.digi.com/support/products/infrastructure-management/digi-portserver-ts/"
},
{
"tags": [
"patch"
],
"url": "https://hub.digi.com/support/products/infrastructure-management/digi-one-sp-ia/"
},
{
"tags": [
"patch"
],
"url": "https://hub.digi.com/support/products/infrastructure-management/digi-one-iap-haz/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.digi.com/getattachment/Resources/Security/Alerts/Improper-authentication-handling-for-Digi-PortServ/improper-authentication-handling.pdf"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
"assignerShortName": "Digi",
"cveId": "CVE-2025-3659",
"datePublished": "2025-05-12T20:40:03.567Z",
"dateReserved": "2025-04-15T19:04:32.817Z",
"dateUpdated": "2025-05-12T22:06:36.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}