Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-36767

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.

Published

2021-10-08T15:15:09.037

Last Modified

2024-11-21T06:14:03.237

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-916
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application digi realport ≤ 1.9-40 Yes
Application digi realport ≤ 4.10.490 Yes
Operating System digi connectport_ts_8\/16_firmware * Yes
Hardware digi connectport_ts_8\/16 - No
Operating System digi connectport_lts_8\/16\/32_firmware * Yes
Hardware digi connectport_lts_8\/16\/32 - No
Operating System digi passport_integrated_console_server_firmware * Yes
Hardware digi passport_integrated_console_server - No
Operating System digi cm_firmware * Yes
Hardware digi cm - No
Operating System digi portserver_ts_firmware * Yes
Hardware digi portserver_ts - No
Operating System digi portserver_ts_mei_firmware * Yes
Hardware digi portserver_ts_mei - No
Operating System digi portserver_ts_mei_hardened_firmware * Yes
Hardware digi portserver_ts_mei_hardened - No
Operating System digi portserver_ts_m_mei_firmware * Yes
Hardware digi portserver_ts_m_mei - No
Operating System digi 6350-sr_firmware * Yes
Hardware digi 6350-sr - No
Operating System digi portserver_ts_p_mei_firmware * Yes
Hardware digi portserver_ts_p_mei - No
Operating System digi transport_wr11_xt_firmware * Yes
Hardware digi transport_wr11_xt - No
Operating System digi one_ia_firmware * Yes
Hardware digi one_ia - No
Operating System digi wr31_firmware * Yes
Hardware digi wr31 - No
Operating System digi wr44_r_firmware * Yes
Hardware digi wr44_r - No
Operating System digi connect_es_firmware * Yes
Hardware digi connect_es - No
Operating System digi wr21_firmware * Yes
Hardware digi wr21 - No
Operating System digi one_iap_firmware * Yes
Hardware digi one_iap - No
Operating System digi one_iap_haz_firmware * Yes
Hardware digi one_iap_haz - No
References