CVE-2025-3659
Critical
Description
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022 * Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020 * Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020 A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
SeverityCritical
CVSS9.4
Exploit probability—
ProductDigi PortServer TS
PublishedMay 12, 2025
First seenMay 12, 2025
Weakness typeCWE-287Improper authentication
How to fix
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Digi International Digi PortServer TS | v ≤ 82000747_AA | — |
| Digi International Digi One SP/Digi One SP IA/Digi One IA | v ≤ 82000774_Z | — |
| Digi International Digi One IAP | v ≤ 82000770 Z | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.