Vulnerability · Published Jul 7, 2026 · Assigned by Digi
CVE-2026-12948Stored Cross-Site Scripting (XSS)
Medium 4.8
In plain English
A medium-severity cross-site scripting in Digi One IA from Digi International. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Digi International | Digi PortServer TS | 82000747_V1 – through 82000747_AB |
| Digi International | Digi One SP | 82000774_Z – through 82000774_AB |
| Digi International | Digi One SP IA | 82000774_Z – through 82000774_AB |
| Digi International | Digi One IA | 82000774_Z – through 82000774_AB |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N