Digi International vulnerabilities
Published CVEs affecting Digi International products: 3 record(s), with severity, exploitation and fixes.
Digi 63xx Family 1Digi One IA 1Digi One SP IA 1Digi One SP 1Digi PortServer TS 1Digi One SP / SP IA / IA 1PortServer TS 1/2/4 1Digi LR54 Family 1Digi IX14 1IX Family 1Digi 54xx Family 1XBee Hive Border Router for Wi-SUN 1XBee Hive Gateway 1Connect EZ Family 1AnywhereUSB Plus Family 1Connect IT Family 1TX Family 1EX Family 1
CVE-2026-75937
Critical · 9.4
CWE-78 Oct 2, 2026
OS Command Injection in Digi Accelerated Linux (DAL OS)
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
CVE-2026-12948
Medium · 4.8
CWE-79 Jul 7, 2026
Stored Cross-Site Scripting (XSS)
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).
CVE-2026-12352
Medium · 5.9
CWE-863 Jul 7, 2026
Incorrect Authorization
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.