Digi vulnerabilities
We track 7 vulnerabilities in Digi products across 4 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on December 9, 2024.
Latest Digi vulnerabilities
- 8.8 High severity
Connectport LTS Firmware: Missing Authorization
An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achieve unauthorized manipulation of resources, which may lead to remote code execution when combined with other issues.
- 8.8 High severity
Connectport LTS Firmware: Files or Directories Accessible to External Parties
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on the local area network (with specific permissions) to upload and execute malicious files, potentiall
- 8.8 High severity
Connectport LTS Firmware: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area network to manipulate URLs to include traversal sequences, potentially leading to unauthorized access
- 8.0 High severity
Connectport LTS Firmware: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentiall
- 9.8 Critical severity
ConnectPort X2D: Execution with Unnecessary Privileges
An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed.
- 7.5 High severity
Passport Firmware: Out-of-bounds Write
Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the string is concatenated to the HTML body.
- 7.5 High severity
Passport Firmware: Out-of-bounds Write
Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.