CVE-2021-37188

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware because the bootloader does not verify that it is authentic, changing the behavior of the gateway...

Design/Logic Flaw

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware because the bootloader does not verify that it is authentic, changing the behavior of the gateway...

Session fixation

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session...

Command injection

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker with knowledge of the protocol to execute arbitrary code on the controller including overwriting firmware, adding/removing...

CVE-2021-37189

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session...

CVE-2021-37189

CVE-2021-37189 affects Digi TransPort Gateway devices up to version 5.2.13.4. The issue is that these devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause cookies to be sent in cleartext over an HTTP session. This behavior is described in the NVD entr...

CVE-2021-37188

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware because the bootloader does not verify that it is authentic, changing the behavior of the gateway...

CVE-2021-37188

CVE-2021-37188 affects Digi TransPort devices (through 2021-07-21). The root cause is a bootloader that does not verify the authenticity of loaded firmware, enabling an authenticated attacker to load customized firmware and thereby change the gateway’s behavior. Exploitation details, impact scope...

CVE-2021-37187

The CVE-2021-37187 issue affects Digi TransPort devices (through 2021-07-21). An authenticated attacker can read a password file containing reversible passwords, enabling decoding of other users’ passwords. Impact is partial confidentiality loss with potential broader exposure within the device. ...

CVE-2021-37187

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file with reversible passwords from the device, which allows decoding of other users' passwords...

CVE-2021-35978

CVE-2021-35978 affects Digi TransPort DR64, SR44 VC74, and WR. The issue arises in the ZING protocol, which allows arbitrary remote command execution with SUPER privileges, enabling an attacker who knows the protocol to run arbitrary code on the controller. Reported impacts include overwriting fi...

Digi International Digi TransPort 数据伪造问题漏洞

The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. The Digi TransPort suffers from a Data Forgery Issue vulnerability that originates from an authenticated attacker who could use the vulnerability to potentially load customized firmware since the...

Digi International Digi TransPort 安全漏洞

The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. A security vulnerability exists in the Digi International Digi TransPort, which can be exploited by an authenticated attacker to read a password file passwords are reversible from the device, whi...

Digi TransPort 安全漏洞

The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. A security vulnerability exists in the Digi TransPort Gateway that stems from them not setting the Secure attribute for sensitive cookies in HTTPS sessions, which could result in a user agent...

Digi TransPort DR64 命令注入漏洞

The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. A security vulnerability exists in the Digi TransPort DR64 that allows arbitrary remote commands to be executed using the SUPER privilege. This allows an attacker to exploit the vulnerability kno...

Digi RealPort has an unspecified vulnerability (CNVD-2021-103406)

Digi RealPort is a proprietary Serial-over-LAN encapsulation protocol. A security vulnerability exists in versions prior to Digi RealPort 4.8.488.0 due to a buffer overflow in the software's handling of ADDP discovery response messages, which could be exploited by an attacker to cause the executi...

Digi RealPort has an unspecified vulnerability

Digi RealPort is a proprietary Serial-over-LAN encapsulation protocol. It provides virtual connectivity to serial devices anywhere on the network by encapsulating ICS protocol data in a TCP-based protocol.A security vulnerability exists in Digi RealPort that could be exploited by an attacker to...

Digi RealPort Licensing Issue Vulnerability

Digi RealPort is a proprietary Serial-over-LAN encapsulation protocol. It provides virtual connectivity to serial devices anywhere on the network by encapsulating ICS protocol data in a TCP-based protocol. Authentication is not performed. No details of the vulnerability are currently available...

CVE-2021-36767

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's...

CVE-2021-36767

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's...