CRITICAL🇵🇱 Wersja polska

CVE-2021-36767

CVSS 9.8v3.1pub. 2021-10-08upd. 2024-11-21

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Digi 6350 Sr

    HW
    Digi
    all versions

  • Digi 6350 Sr Firmware

    OS
    Digi
    all versions

  • Digi Cm

    HW
    Digi
    all versions

  • Digi Cm Firmware

    OS
    Digi
    all versions

  • Digi Connect Es

    HW
    Digi
    all versions

  • Digi Connect Es Firmware

    OS
    Digi
    all versions

  • Digi Connectport Lts 8\/16\/32

    HW
    Digi
    all versions

  • Digi Connectport Lts 8\/16\/32 Firmware

    OS
    Digi
    all versions

  • Digi Connectport Ts 8\/16

    HW
    Digi
    all versions

  • Digi Connectport Ts 8\/16 Firmware

    OS
    Digi
    all versions

  • Digi One Ia

    HW
    Digi
    all versions

  • Digi One Ia Firmware

    OS
    Digi
    all versions

  • Digi One Iap

    HW
    Digi
    all versions

  • Digi One Iap Firmware

    OS
    Digi
    all versions

  • Digi One Iap Haz

    HW
    Digi
    all versions

  • Digi One Iap Haz Firmware

    OS
    Digi
    all versions

  • Digi Passport Integrated Console Server

    HW
    Digi
    all versions

  • Digi Passport Integrated Console Server Firmware

    OS
    Digi
    all versions

  • Digi Portserver Ts

    HW
    Digi
    all versions

  • Digi Portserver Ts Firmware

    OS
    Digi
    all versions

  • Digi Portserver Ts Mei

    HW
    Digi
    all versions

  • Digi Portserver Ts Mei Firmware

    OS
    Digi
    all versions

  • Digi Portserver Ts Mei Hardened

    HW
    Digi
    all versions

  • Digi Portserver Ts Mei Hardened Firmware

    OS
    Digi
    all versions

  • Digi Portserver Ts M Mei

    HW
    Digi
    all versions

  • Digi Portserver Ts M Mei Firmware

    OS
    Digi
    all versions

  • Digi Portserver Ts P Mei

    HW
    Digi
    all versions

  • Digi Portserver Ts P Mei Firmware

    OS
    Digi
    all versions

  • Digi Realport

    APP
    Digi
    ≤ 1.9-40≤ 4.10.490

  • Digi Transport Wr11 Xt

    HW
    Digi
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-4299CRITICAL9.0PL ✓same product

Digi RealPort Protocol — podatność na atak replay umożliwiająca ominięcie uwierzytelnienia

CVE-2021-35978CRITICAL9.8PL ✓same product

RCE z uprawnieniami SUPER w protokole ZING urządzeń Digi TransPort

CVE-2021-35977CRITICAL9.8PL ✓same product

Buffer overflow w Digi RealPort — wykonanie dowolnego kodu przez ADDP

CVE-2021-37188HIGH8.8same product

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load custo...

CVE-2021-37189HIGH7.5same product

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribu...