What is CVE-2021-37189?

CVE-2021-37189 is a high-severity vulnerability in Digi Transport Wr11, classified under Missing Encryption of Sensitive Data. CVSS score: 7.5/10. Published 2021-12-10.

How severe is CVE-2021-37189?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Digi Transport Wr11

CVE-2021-37189

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

EPSS: 0.006 (44.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Digi Transport_wr11
Digi Transport_wr11_firmware
Digi Transport_wr11_xt
Digi Transport_wr11_xt_firmware
Digi Transport_wr21
Digi Transport_wr21_firmware
Digi Transport_wr31
Digi Transport_wr31_firmware
Digi Transport_wr41
Digi Transport_wr41_firmware

Weakness classification (CWE)

CWE-311 — Missing Encryption of Sensitive Data

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-37189?: CVE-2021-37189 is a high-severity vulnerability in Digi Transport Wr11, classified under Missing Encryption of Sensitive Data. CVSS score: 7.5/10. Published 2021-12-10.
How severe is CVE-2021-37189?: High severity. CVSS v3 base score is 7.5 out of 10.