OS Command Injection in Digi Accelerated Linux (DAL OS)
Priority MEDIUM 43CWE-78Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Digi International | IX Family | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | EX Family | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | TX Family | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | Connect IT Family | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | AnywhereUSB Plus Family | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | Connect EZ Family | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | XBee Hive Gateway | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | XBee Hive Border Router for Wi-SUN | 21.8.24.139 – 26.7.90.14 | — | No fix listed | CNA |
| Digi International | Digi 54xx Family | up to 21.8.24.139 | — | No fix listed | CNA |
| Digi International | Digi 63xx Family | 21.8.24.139 – 22.5.50.66 | — | No fix listed | CNA |
| Digi International | Digi IX14 | 21.8.24.139 – 22.5.50.62 | — | No fix listed | CNA |
| Digi International | Digi LR54 Family | 21.8.24.139 – 23.12.1.56 | — | No fix listed | CNA |
- IX Family VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- EX Family VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- TX Family VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- Connect IT Family VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- AnywhereUSB Plus Family VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- Connect EZ Family VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- XBee Hive Gateway VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- XBee Hive Border Router for Wi-SUN VendorDigi International Affected 21.8.24.139 – 26.7.90.14 Fixed in — No fix listed CNA
- Digi 54xx Family VendorDigi International Affected up to 21.8.24.139 Fixed in — No fix listed CNA
- Digi 63xx Family VendorDigi International Affected 21.8.24.139 – 22.5.50.66 Fixed in — No fix listed CNA
- Digi IX14 VendorDigi International Affected 21.8.24.139 – 22.5.50.62 Fixed in — No fix listed CNA
- Digi LR54 Family VendorDigi International Affected 21.8.24.139 – 23.12.1.56 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-75937
- 2026-10-03 Alias added: GHSA-qqmh-gh5m-j2h2
- 2026-10-03 CISA SSVC decision points changed
References
Advisory 1
More Digi International vulnerabilities
- TI-2021-16016 Digi PortServer TS 16 Improper Authentication CVSS 3.1CRITICAL 9.8
- TI-2025-03222 Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP CVSS 4.0CRITICAL 9.4
- TI-2023-03975 Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication CVSS 3.1CRITICAL 9.0
- TI-2006-04307 Integer overflow in AnywhereUSB/5 1.80.00 allows local users to cause a denial of service… CVSS 2.0HIGH 7.5
- TI-2026-10612 Incorrect authorization in Digi International PortServer TS 1/2/4 CVSS 3.1MEDIUM 5.9
- TI-2026-11021 Stored cross-site scripting (XSS) in Digi PortServer TS CVSS 4.0MEDIUM 4.8
Sources
- CVE-2026-75937 · CVE Program
- CVE-2026-75937 · NVD
- FIRST EPSS
- GHSA-qqmh-gh5m-j2h2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences