CVE-2026-75937: Digi International IX Family, инжекция

Описание

Оригинално описание

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Засегнати продукти

• Digi International IX Family: 21.8.24.139 до 26.7.90.14
• Digi International EX Family: 21.8.24.139 до 26.7.90.14
• Digi International TX Family: 21.8.24.139 до 26.7.90.14
• Digi International Connect IT Family: 21.8.24.139 до 26.7.90.14
• Digi International AnywhereUSB Plus Family: 21.8.24.139 до 26.7.90.14
• Digi International Connect EZ Family: 21.8.24.139 до 26.7.90.14
• Digi International XBee Hive Gateway: 21.8.24.139 до 26.7.90.14
• Digi International XBee Hive Border Router for Wi-SUN: 21.8.24.139 до 26.7.90.14
• Digi International Digi 54xx Family: до 21.8.24.139
• Digi International Digi 63xx Family: 21.8.24.139 до 22.5.50.66
• Digi International Digi IX14: 21.8.24.139 до 22.5.50.62
• Digi International Digi LR54 Family: 21.8.24.139 до 23.12.1.56

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-75937
• https://nvd.nist.gov/vuln/detail/CVE-2026-75937
• https://www.digi.com/resources/security