Vulnerability · Published May 12, 2025 · Assigned by Digi
CVE-2025-3659Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP
Critical 9.4
In plain English
A critical-severity improper authentication in Digi One IAP from Digi International. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022 * Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020 * Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020 A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Digi International | Digi PortServer TS | 0 – through 82000747_AA |
| Digi International | Digi One SP/Digi One SP IA/Digi One IA | 0 – through 82000774_Z |
| Digi International | Digi One IAP | 0 – through 82000770 Z |
Weakness: CWE-287 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
References
- https://hub.digi.com/support/products/infrastructure-management/digi-portserver-ts/ patch
- https://hub.digi.com/support/products/infrastructure-management/digi-one-sp-ia/ patch
- https://hub.digi.com/support/products/infrastructure-management/digi-one-iap-haz/ patch
- https://www.digi.com/getattachment/Resources/Security/Alerts/Improper-authentication-handling-for-Digi-PortServ/improper-authentication-handling.pdf vendor-advisory