Digi
2 CVEs across 87 Digi products. Browse Digi vulnerabilities, severities, and proof-of-concept exploits.
Digi products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50628 | High | 8.8 | 2024-12-09 | An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achieve unauthorized mani… |
CVE-2024-50627 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on… |
CVE-2024-50626 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area n… |
CVE-2024-50625 | High | 8.0 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file pat… |
CVE-2023-4299 | Critical | 9.0 | 2023-08-31 | Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment. |
CVE-2022-2634 | Critical | 10.0 | 2022-08-10 | An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This c… |
CVE-2022-26953 | High | 7.5 | 2022-04-06 | Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowin… |
CVE-2022-26952 | High | 7.5 | 2022-04-06 | Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is… |
CVE-2021-37189 | High | 7.5 | 2021-12-10 | An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which… |
CVE-2021-37188 | High | 8.8 | 2021-12-10 | An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware (because the bootloader does not v… |
CVE-2021-37187 | Medium | 6.5 | 2021-12-10 | An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the d… |
CVE-2021-35978 | Critical | 9.8 | 2021-12-10 | An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allo… |
CVE-2021-36767 | Critical | 9.8 | 2021-10-08 | In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection inef… |
CVE-2021-35979 | High | 8.1 | 2021-10-08 | An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication. |
CVE-2021-35977 | Critical | 9.8 | 2021-10-08 | An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response messages. This coul… |
CVE-2021-38412 | Critical | 9.6 | 2021-09-17 | Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication… |
CVE-2020-12878 | High | 7.8 | 2021-02-18 | Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /e… |
CVE-2020-10136 | Medium | 5.3 | 2020-06-02 | IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access… |
CVE-2017-18868 | High | 7.7 | 2020-05-21 | Digi XBee 2 devices do not have an effective protection mechanism against remote AT commands, because of issues related to the network stack upon which the Zig… |
CVE-2020-6973 | Medium | 6.2 | 2020-02-13 | Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vulnerabilities exis… |
CVE-2020-6975 | Medium | 4.9 | 2020-02-12 | Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Successful exploitation of this vulnerability coul… |
CVE-2020-8822 | Medium | 4.8 | 2020-02-10 | Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application. |
CVE-2019-18859 | Medium | 6.1 | 2020-01-09 | Digi AnywhereUSB 14 allows XSS via a link for the Digi Page. |
CVE-2018-20162 | Critical | 9.9 | 2019-03-21 | Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privileges to bypass a restr… |
CVE-2004-1973 | | 2004-04-27 | DiGi Web Server allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request that contains a large number of / (slash) charac… |