CVE-2021-36767
Critical
Description
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.
SeverityCritical
CVSS9.8
Exploit probability—
ProductDigi Realport
PublishedOct 8, 2021
First seenOct 8, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digi realport | v ≤ 1.9-40, v ≤ 4.10.490 | — |
| digi connectport_ts_8\/16_firmware | No range specified | — |
| digi connectport_lts_8\/16\/32_firmware | No range specified | — |
| digi passport_integrated_console_server_firmware | No range specified | — |
| digi cm_firmware | No range specified | — |
| digi portserver_ts_firmware | No range specified | — |
| digi portserver_ts_mei_firmware | No range specified | — |
| digi portserver_ts_mei_hardened_firmware | No range specified | — |
| digi portserver_ts_m_mei_firmware | No range specified | — |
| digi 6350-sr_firmware | No range specified | — |
| digi portserver_ts_p_mei_firmware | No range specified | — |
| digi transport_wr11_xt_firmware | No range specified | — |
| digi one_ia_firmware | No range specified | — |
| digi wr31_firmware | No range specified | — |
| digi wr44_r_firmware | No range specified | — |
| digi connect_es_firmware | No range specified | — |
| digi wr21_firmware | No range specified | — |
| digi one_iap_firmware | No range specified | — |
| digi one_iap_haz_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.