What is CVE-2021-38412?

CVE-2021-38412 is a critical-severity vulnerability in Digi Portserver Ts 16, classified under Improper Authentication. CVSS score: 9.6/10. Published 2021-09-17.

How severe is CVE-2021-38412?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Auth bypass in Digi Portserver Ts 16

CVE-2021-38412

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.

Vulnerability class: Broken Authentication

EPSS: 0.013 (68.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.

Affected products

Digi Portserver_ts_16
Digi Portserver_ts_16_firmware — versions 82000684, 82000685
Digi International Portserver Ts 16 — versions Firmware

Weakness classification (CWE)

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-38412?: CVE-2021-38412 is a critical-severity vulnerability in Digi Portserver Ts 16, classified under Improper Authentication. CVSS score: 9.6/10. Published 2021-09-17.
How severe is CVE-2021-38412?: Critical severity. CVSS v3 base score is 9.6 out of 10.