The vulnerability of the remote access software for devices on the Digi RealPort network lies in the use of a password hash instead of a plain-text password for authentication. This allows attackers to compromise the target system.

🗓️ 21 Sep 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Digi RealPort remote access vulnerability uses password hash for authentication, enabling remote compromise.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2023-4299	1 Sep 202300:13	–	circl
CNNVD	Digi RealPort 安全漏洞	31 Aug 202300:00	–	cnnvd
CVE	CVE-2023-4299	31 Aug 202320:45	–	cve
Cvelist	CVE-2023-4299 Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication	31 Aug 202320:45	–	cvelist
EUVD	EUVD-2023-54170	3 Oct 202520:07	–	euvd
ICS	Digi RealPort Protocol	31 Aug 202306:00	–	ics
NVD	CVE-2023-4299	31 Aug 202321:15	–	nvd
OSV	CVE-2023-4299	31 Aug 202321:15	–	osv
Prion	Authentication flaw	31 Aug 202321:15	–	prion
Positive Technologies	PT-2023-5295 · Digi · Digi Realport	31 Aug 202300:00	–	ptsecurity

Vulners

Node

digi_international,digi_realportRange<4.8.488.0

OR

digi_international,digi_realportRange<1.9-40

OR

digi_international,digi_connectport_ts_8/16Range<2.26.2.4

OR

digi_international,digi_connectport_lts_8/16/32Range<1.4.9

OR

digi_international,digi_connect_esRange<2.26.2.4

Source	Link
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-243-04
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2023090414
vuldb	www.vuldb.com/
digi	www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf
web	www.web.nvd.nist.gov/view/vuln/detail

23 Oct 2023 00:00Current

CVSS 27.6

CVSS 39

EPSS0.0002

Digi RealPort password hash remote access authentication flaw remote compromise