Vulnerability · Published Oct 2, 2026 · Assigned by Digi
CVE-2026-75937OS Command Injection in Digi Accelerated Linux (DAL OS)
Critical 9.4
In plain English
A critical-severity OS command injection in AnywhereUSB Plus Family from Digi International. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Digi International | IX Family | 21.8.24.139 – through 26.7.90.14 |
| Digi International | EX Family | 21.8.24.139 – through 26.7.90.14 |
| Digi International | TX Family | 21.8.24.139 – through 26.7.90.14 |
| Digi International | Connect IT Family | 21.8.24.139 – through 26.7.90.14 |
| Digi International | AnywhereUSB Plus Family | 21.8.24.139 – through 26.7.90.14 |
| Digi International | Connect EZ Family | 21.8.24.139 – through 26.7.90.14 |
| Digi International | XBee Hive Gateway | 21.8.24.139 – through 26.7.90.14 |
| Digi International | XBee Hive Border Router for Wi-SUN | 21.8.24.139 – through 26.7.90.14 |
| Digi International | Digi 54xx Family | 0 – through 21.8.24.139 |
| Digi International | Digi 63xx Family | 21.8.24.139 – through 22.5.50.66 |
| Digi International | Digi IX14 | 21.8.24.139 – through 22.5.50.62 |
| Digi International | Digi LR54 Family | 21.8.24.139 – through 23.12.1.56 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://www.digi.com/resources/security mitigation, vendor-advisory