Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-35978

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.

Published

2021-12-10T13:15:07.620

Last Modified

2024-11-21T06:12:52.670

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-77
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System digi transport_dr64_firmware ≤ 5.2.4.9 Yes
Hardware digi transport_dr64 - No
Operating System digi transport_sr44_firmware * Yes
Hardware digi transport_sr44 - No
Operating System digi transport_vc74_firmware ≤ 5.2.4.9 Yes
Hardware digi transport_vc74 - No
Operating System digi transport_wr11_firmware ≤ 8.2.1.3 Yes
Hardware digi transport_wr11 - No
Operating System digi transport_wr11_xt_firmware ≤ 8.2.1.3 Yes
Hardware digi transport_wr11_xt - No
Operating System digi transport_wr21_firmware ≤ 8.2.1.3 Yes
Hardware digi transport_wr21 - No
Operating System digi transport_wr31_firmware ≤ 8.2.1.3 Yes
Hardware digi transport_wr31 - No
Operating System digi transport_wr41_firmware ≤ 5.2.4.6 Yes
Operating System digi transport_wr41_firmware ≤ 6.1.3.5 Yes
Operating System digi transport_wr41_firmware ≤ 8.3.1.2 Yes
Hardware digi transport_wr41 - No
Operating System digi transport_wr44_firmware ≤ 8.3.1.2 Yes
Hardware digi transport_wr44 v2 No
References