Description
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022 * Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020 * Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020 A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Digi International Digi PortServer TS
Default version status: affected
0 to ≤ 82000747_AAaffected
Digi International Digi One SP/Digi One SP IA/Digi One IA
Default version status: affected
0 to ≤ 82000774_Zaffected
Digi International Digi One IAP
Default version status: affected
0 to ≤ 82000770 Zaffected
References
- https://hub.digi.com/support/products/infrastructure-management/digi-portserver-ts/ ↗
- https://hub.digi.com/support/products/infrastructure-management/digi-one-sp-ia/ ↗
- https://hub.digi.com/support/products/infrastructure-management/digi-one-iap-haz/ ↗
- https://www.digi.com/getattachment/Resources/Security/Alerts/Improper-authentication-handling-for-Digi-PortServ/improper-authentication-handling.pdf ↗