Digi vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-75937 A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands withCritical 9.4 · Oct 2, 2026
• CVE-2025-3659 Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to anCritical 9.4 · May 12, 2025
• CVE-2024-50628 An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12.High 8.8 · Dec 9, 2024
• CVE-2024-50627 An issue was discovered in Digi ConnectPort LTS before 1.4.12.High 8.8 · Dec 9, 2024
• CVE-2024-50626 An issue was discovered in Digi ConnectPort LTS before 1.4.12.High 8.8 · Dec 9, 2024
• CVE-2024-50625 An issue was discovered in Digi ConnectPort LTS before 1.4.12.High 8 · Dec 9, 2024
• CVE-2023-4299 Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.Critical 9 · Aug 31, 2023
• CVE-2022-2634 An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application.Critical 10 · Aug 10, 2022
• CVE-2022-26953 Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow.High 7.5 · Apr 5, 2022
• CVE-2022-26952 Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is High 7.5 · Apr 5, 2022
• CVE-2021-37189 An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4.High 7.5 · Dec 10, 2021
• CVE-2021-37188 An issue was discovered on Digi TransPort devices through 2021-07-21.High 8.8 · Dec 10, 2021
• CVE-2021-35978 An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR.Critical 9.8 · Dec 10, 2021
• CVE-2021-36767 In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffCritical 9.8 · Oct 8, 2021
• CVE-2021-35979 An issue was discovered in Digi RealPort through 4.8.488.0.High 8.1 · Oct 8, 2021
• CVE-2021-35977 An issue was discovered in Digi RealPort for Windows through 4.8.488.0.Critical 9.8 · Oct 8, 2021
• CVE-2021-38412 Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication Critical 9.6 · Sep 17, 2021
• CVE-2020-12878 Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etHigh 7.8 · Feb 17, 2021
• CVE-2017-18868 Digi XBee 2 devices do not have an effective protection mechanism against remote AT commands, because of issues related to the network stack upon which the ZigBHigh 7.7 · May 21, 2020
• CVE-2018-20162 Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privileges to bypass a restriCritical 9.9 · Mar 21, 2019
• CVE-2006-4459 Integer overflow in AnywhereUSB/5 1.80.00 allows local users to cause a denial of service (crash) via a 1 byte header size specified in the USB string descriptoHigh 7.5 · Sep 5, 2006