Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-12948

Stored Cross-Site Scripting (XSS)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Digi

Description

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Digi International Digi PortServer TS

Default version status: unaffected

  • 82000747_V1 to ≤ 82000747_ABaffected

Digi International Digi One SP

Default version status: unaffected

  • 82000774_Z to ≤ 82000774_ABaffected

Digi International Digi One SP IA

Default version status: unaffected

  • 82000774_Z to ≤ 82000774_ABaffected

Digi International Digi One IA

Default version status: unaffected

  • 82000774_Z to ≤ 82000774_ABaffected

References