Digi Passport Firmware vulnerabilities

3 CVEs affecting Digi Passport Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4299, published 2023-08-31.

More from Digi.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-26952, published 2022-04-06. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.
• CVE-2022-26953, published 2022-04-06. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the…
• CVE-2023-4299, published 2023-08-31. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.