CVE-2021-37189
High
Description
An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
SeverityHigh
CVSS7.5
Exploit probability—
ProductDigi Transport Wr11 Firmware
PublishedDec 10, 2021
First seenDec 10, 2021
How to fix
Update
- digi transport_wr11_firmware6.0.0.0 or later
- digi transport_wr11_xt_firmware6.0.0.0 or later
- digi transport_wr21_firmware6.0.0.0 or later
- digi transport_wr31_firmware6.0.0.0 or later
- digi transport_wr41_firmware6.0.0.0 or later
- digi transport_wr44_firmware6.0.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digi transport_wr11_firmware | v < 6.0.0.0 | 6.0.0.0 |
| digi transport_wr11_xt_firmware | v < 6.0.0.0 | 6.0.0.0 |
| digi transport_wr21_firmware | v < 6.0.0.0 | 6.0.0.0 |
| digi transport_wr31_firmware | v < 6.0.0.0 | 6.0.0.0 |
| digi transport_wr41_firmware | v < 6.0.0.0 | 6.0.0.0 |
| digi transport_wr44_firmware | v < 6.0.0.0 | 6.0.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.