Skip to content
OpenAdvisories
Critical · 9.0 CVE-2023-4299 EUVD-2023-54170GHSA-6mw3-9jr4-xc73

Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication

Published Aug 31, 2023 · Updated Jan 16, 2025 · Assigned by icscert

Vendor: Digi International Product: Digi 6350-SR Product: Digi CM Console Server Product: Digi Connect ES Product: Digi Connect SP Product: Digi ConnectCore 8X products Product: Digi ConnectPort LTS 8/16/32 Product: Digi ConnectPort TS 8/16 Product: Digi One IA Product: Digi One IAP Family Product: Digi One SP Product: Digi One SP IA Product: Digi Passport Console Server Product: Digi PortServer TS Product: Digi PortServer TS M MEI Product: Digi PortServer TS MEI Product: Digi PortServer TS MEI Hardened Product: Digi PortServer TS P MEI Product: Digi RealPort Product: Digi WR11 XT Product: Digi WR21 Product: Digi WR31 Product: Digi WR44 R

Description

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

Affected products

VendorProductAffectedFixed
Digi International Digi RealPort ≤ 4.8.488.0, ≤ 1.9-40 —
Digi International Digi ConnectPort TS 8/16 < 2.26.2.4 2.26.2.4
Digi International Digi Passport Console Server all versions —
Digi International Digi ConnectPort LTS 8/16/32 < 1.4.9 1.4.9
Digi International Digi CM Console Server all versions —
Digi International Digi PortServer TS all versions —
Digi International Digi PortServer TS MEI all versions —
Digi International Digi PortServer TS MEI Hardened all versions —
Digi International Digi PortServer TS M MEI all versions —
Digi International Digi PortServer TS P MEI all versions —
Digi International Digi One IAP Family all versions —
Digi International Digi One IA all versions —
Digi International Digi One SP IA all versions —
Digi International ​Digi One SP all versions —
Digi International Digi WR31 all versions —
Digi International Digi WR11 XT all versions —
Digi International Digi WR44 R all versions —
Digi International Digi WR21 all versions —
Digi International Digi Connect ES < 2.26.2.4 2.26.2.4
Digi International Digi Connect SP all versions —
Digi International Digi 6350-SR — all versions
Digi International Digi ConnectCore 8X products — all versions

Advisories 1

References