CVE-2021-36767: Digi 6350-Sr Firmware

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.

Affected products

• Digi 6350-Sr Firmware: any version
• Digi Cm Firmware: any version
• Digi Connect Es Firmware: any version
• Digi Connectport LTS 8/16/32 Firmware: any version
• Digi Connectport Ts 8/16 Firmware: any version
• Digi One Ia Firmware: any version
• Digi One Iap Firmware: any version
• Digi One Iap Haz Firmware: any version
• Digi Passport Integrated Console Server Firmware: any version
• Digi Portserver Ts Firmware: any version
• Digi Portserver Ts M Mei Firmware: any version
• Digi Portserver Ts Mei Firmware: any version
• Digi Portserver Ts Mei Hardened Firmware: any version
• Digi Portserver Ts P Mei Firmware: any version
• Digi Realport: up to and including 1.9-40; up to and including 4.10.490
• Digi Transport WR11 Xt Firmware: any version
• Digi WR21 Firmware: any version
• Digi WR31 Firmware: any version
• Digi WR44 R Firmware: any version

Published 2021-10-08. Last modified 2026-06-17.