Vulnerability · Published Sep 17, 2021 · Assigned by icscert
CVE-2021-38412Digi PortServer TS 16 Improper Authentication
Critical 9.6
In plain English
A critical-severity improper authentication in PortServer TS 16 from Digi International. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Digi International | PortServer TS 16 | Firmware – through 82000684 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-257-01 x_refsource_MISC