CVE-2025-3659: falha crítica em Digi PortServer TS
Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.4epss 0.3%
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
* Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022
* Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020
* Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Produtos afetados
Digi International · Digi One IAPDigi International · Digi One SP/Digi One SP IA/Digi One IADigi International · Digi PortServer TSCVEs relacionadas — Digi PortServer TS
No mesmo produto, das mais perigosas para as menos.
Referências
https://hub.digi.com/support/products/infrastructure-management/digi-one-iap-haz/https://hub.digi.com/support/products/infrastructure-management/digi-one-sp-ia/https://hub.digi.com/support/products/infrastructure-management/digi-portserver-ts/https://www.digi.com/getattachment/Resources/Security/Alerts/Improper-authentication-handling-for-Digi-PortServ/improper-authentication-handling.pdf