Description
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Digi International IX Family
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International EX Family
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International TX Family
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International Connect IT Family
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International AnywhereUSB Plus Family
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International Connect EZ Family
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International XBee Hive Gateway
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International XBee Hive Border Router for Wi-SUN
Default version status: unaffected
21.8.24.139 to ≤ 26.7.90.14affected
Digi International Digi 54xx Family
Default version status: unaffected
0 to ≤ 21.8.24.139affected
Digi International Digi 63xx Family
Default version status: unaffected
21.8.24.139 to ≤ 22.5.50.66affected
Digi International Digi IX14
Default version status: unaffected
21.8.24.139 to ≤ 22.5.50.62affected
Digi International Digi LR54 Family
Default version status: unaffected
21.8.24.139 to ≤ 23.12.1.56affected