CVE-2026-75937criticalCWE-78

CVE-2026-75937: critical vulnerability in Digi International AnywhereUSB Plus Family

OS Command Injection in Digi Accelerated Linux (DAL OS)

Published · Updated

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.5%
exploitation probability
0.5%top 57% of all CVEs
observed exploitation
nono source reports it
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Digi International · AnywhereUSB Plus FamilyDigi International · Connect EZ FamilyDigi International · Connect IT FamilyDigi International · Digi 54xx FamilyDigi International · Digi 63xx FamilyDigi International · Digi IX14Digi International · Digi LR54 FamilyDigi International · EX FamilyDigi International · IX FamilyDigi International · TX FamilyDigi International · XBee Hive Border Router for Wi-SUNDigi International · XBee Hive Gateway
References
https://www.digi.com/resources/security