Description
An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.
The API is not enabled by default, and a valid API token is required to perform the attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nettec AS | Digi On-Prem Manager | 24.12.5 – < 25.08.5 | 25.08.5 |
References
- https://dom.nettec.no/security-advisories/DOM-25-001/ vendor-advisory