Vulnerability-Lookup

CVE-2026-75937 (GCVE-0-2026-75937)

Vulnerability from cvelistv5 – Published: 2026-10-02 20:33 – Updated: 2026-10-03 15:52

Title

OS Command Injection in Digi Accelerated Linux (DAL OS)

Summary

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-03 15:47 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

Digi CNA under the icscert root

CNA scorecard – unranked: 3 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.digi.com/resources/security	mitigationvendor-advisory

Impacted products

12 products

Vendor	Product	Version	CPE status
Digi International	IX Family	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	EX Family	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	TX Family	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	Connect IT Family	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	AnywhereUSB Plus Family	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	Connect EZ Family	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	XBee Hive Gateway	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	XBee Hive Border Router for Wi-SUN	Affected: 21.8.24.139 , ≤ 26.7.90.14 (custom)	guessed
Digi International	Digi 54xx Family	Affected: 0 , ≤ 21.8.24.139 (custom)	guessed
Digi International	Digi 63xx Family	Affected: 21.8.24.139 , ≤ 22.5.50.66 (custom)	guessed
Digi International	Digi IX14	Affected: 21.8.24.139 , ≤ 22.5.50.62 (custom)	guessed
Digi International	Digi LR54 Family	Affected: 21.8.24.139 , ≤ 23.12.1.56 (custom)	guessed

Credits

美团众包骑手:键盘手欧多克

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75937",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:47:40.910645Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:52:55.213Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "IX Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EX Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TX Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Connect IT Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AnywhereUSB Plus Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Connect EZ Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XBee Hive Gateway",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XBee Hive Border Router for Wi-SUN",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi 54xx Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "21.8.24.139",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi 63xx Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "22.5.50.66",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi IX14",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "22.5.50.62",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi LR54 Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "23.12.1.56",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u7f8e\u56e2\u4f17\u5305\u9a91\u624b:\u952e\u76d8\u624b\u6b27\u591a\u514b"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u0026nbsp;Disable the web server when not configuring the device."
            }
          ],
          "value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u00a0Disable the web server when not configuring the device."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T20:33:56.823Z",
        "orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
        "shortName": "Digi"
      },
      "references": [
        {
          "tags": [
            "mitigation",
            "vendor-advisory"
          ],
          "url": "https://www.digi.com/resources/security"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "OS Command Injection in Digi Accelerated Linux (DAL OS)",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
    "assignerShortName": "Digi",
    "cveId": "CVE-2026-75937",
    "datePublished": "2026-10-02T20:33:56.823Z",
    "dateReserved": "2026-08-18T15:53:39.284Z",
    "dateUpdated": "2026-10-03T15:52:55.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-75937",
      "date": "2026-10-22",
      "epss": "0.00528",
      "percentile": "0.43848"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "IX Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "EX Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "TX Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Connect IT Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "AnywhereUSB Plus Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Connect EZ Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "XBee Hive Gateway",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "XBee Hive Border Router for Wi-SUN",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "26.7.90.14",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Digi 54xx Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "21.8.24.139",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Digi 63xx Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "22.5.50.66",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Digi IX14",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "22.5.50.62",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Digi LR54 Family",
                "vendor": "Digi International",
                "versions": [
                  {
                    "lessThanOrEqual": "23.12.1.56",
                    "status": "affected",
                    "version": "21.8.24.139",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "e8a6bb0b-e373-42b1-a5de-93e314325576"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u00a0Disable the web server when not configuring the device."
          }
        ],
        "id": "CVE-2026-75937",
        "lastModified": "2026-10-06T15:08:38.397",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "e8a6bb0b-e373-42b1-a5de-93e314325576",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-75937",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:47:40.910645Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-02T21:16:56.337",
        "references": [
          {
            "source": "e8a6bb0b-e373-42b1-a5de-93e314325576",
            "url": "https://www.digi.com/resources/security"
          }
        ],
        "sourceIdentifier": "e8a6bb0b-e373-42b1-a5de-93e314325576",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "e8a6bb0b-e373-42b1-a5de-93e314325576",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-75937",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-03T15:47:40.910645Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-03T15:51:54.222Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "IX Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "EX Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "TX Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Connect IT Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "AnywhereUSB Plus Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Connect EZ Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "XBee Hive Gateway",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "XBee Hive Border Router for Wi-SUN",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "26.7.90.14",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Digi 54xx Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "21.8.24.139",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Digi 63xx Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "22.5.50.66",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Digi IX14",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "22.5.50.62",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Digi LR54 Family",
              "vendor": "Digi International",
              "versions": [
                {
                  "lessThanOrEqual": "23.12.1.56",
                  "status": "affected",
                  "version": "21.8.24.139",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "\u7f8e\u56e2\u4f17\u5305\u9a91\u624b:\u952e\u76d8\u624b\u6b27\u591a\u514b"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u0026nbsp;Disable the web server when not configuring the device."
                }
              ],
              "value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u00a0Disable the web server when not configuring the device."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-02T20:33:56.823Z",
            "orgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
            "shortName": "Digi"
          },
          "references": [
            {
              "tags": [
                "mitigation",
                "vendor-advisory"
              ],
              "url": "https://www.digi.com/resources/security"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "OS Command Injection in Digi Accelerated Linux (DAL OS)",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e8a6bb0b-e373-42b1-a5de-93e314325576",
        "assignerShortName": "Digi",
        "cveId": "CVE-2026-75937",
        "datePublished": "2026-10-02T20:33:56.823Z",
        "dateReserved": "2026-08-18T15:53:39.284Z",
        "dateUpdated": "2026-10-03T15:52:55.213Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-75937

Vulnerability from fkie_nvd - Published: 2026-10-02 21:16 - Updated: 2026-10-06 15:08

Severity

9.4 (Critical) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Summary

References

	URL	Tags
	e8a6bb0b-e373-42b1-a5de-93e314325576	https://www.digi.com/resources/security

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "IX Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EX Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TX Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Connect IT Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AnywhereUSB Plus Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Connect EZ Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XBee Hive Gateway",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XBee Hive Border Router for Wi-SUN",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "26.7.90.14",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi 54xx Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "21.8.24.139",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi 63xx Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "22.5.50.66",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi IX14",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "22.5.50.62",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digi LR54 Family",
          "vendor": "Digi International",
          "versions": [
            {
              "lessThanOrEqual": "23.12.1.56",
              "status": "affected",
              "version": "21.8.24.139",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "e8a6bb0b-e373-42b1-a5de-93e314325576"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u00a0Disable the web server when not configuring the device."
    }
  ],
  "id": "CVE-2026-75937",
  "lastModified": "2026-10-06T15:08:38.397",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "e8a6bb0b-e373-42b1-a5de-93e314325576",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-75937",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-03T15:47:40.910645Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-02T21:16:56.337",
  "references": [
    {
      "source": "e8a6bb0b-e373-42b1-a5de-93e314325576",
      "url": "https://www.digi.com/resources/security"
    }
  ],
  "sourceIdentifier": "e8a6bb0b-e373-42b1-a5de-93e314325576",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "e8a6bb0b-e373-42b1-a5de-93e314325576",
      "type": "Secondary"
    }
  ]
}

GHSA-QQMH-GH5M-J2H2

Vulnerability from github – Published: 2026-10-02 21:32 – Updated: 2026-10-02 21:32

Details

Severity

9.4 (Critical)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-75937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-02T21:16:56Z",
    "severity": "CRITICAL"
  },
  "details": "A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device.\u00a0Disable the web server when not configuring the device.",
  "id": "GHSA-qqmh-gh5m-j2h2",
  "modified": "2026-10-02T21:32:07Z",
  "published": "2026-10-02T21:32:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75937"
    },
    {
      "type": "WEB",
      "url": "https://www.digi.com/resources/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-75937 (GCVE-0-2026-75937)

FKIE_CVE-2026-75937

GHSA-QQMH-GH5M-J2H2

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour