Vulnerability details
CVE-2026-75937
Digi International AnywhereUSB Plus FamilyDigi International Connect EZ FamilyDigi International Connect IT FamilyDigi International Digi 54xx FamilyDigi International Digi 63xx FamilyDigi International Digi IX14
OS Command Injection in Digi Accelerated Linux (DAL OS)
CVSS 4.0
9.4Critical
Official description
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (Digi) | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Digi International | AnywhereUSB Plus Family | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
| Digi International | Connect EZ Family | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
| Digi International | Connect IT Family | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
| Digi International | Digi 54xx Family | v ≤ 21.8.24.139 | CVEProject cvelistV5 (CNA) |
| Digi International | Digi 63xx Family | 21.8.24.139 ≤ v ≤ 22.5.50.66 | CVEProject cvelistV5 (CNA) |
| Digi International | Digi IX14 | 21.8.24.139 ≤ v ≤ 22.5.50.62 | CVEProject cvelistV5 (CNA) |
| Digi International | Digi LR54 Family | 21.8.24.139 ≤ v ≤ 23.12.1.56 | CVEProject cvelistV5 (CNA) |
| Digi International | EX Family | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
| Digi International | IX Family | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
| Digi International | TX Family | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
| Digi International | XBee Hive Border Router for Wi-SUN | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
| Digi International | XBee Hive Gateway | 21.8.24.139 ≤ v ≤ 26.7.90.14 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://www.digi.com/resources/security mitigationvendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-03
- Last updated
- 2026-10-03
- State
- Published
- Assigner (CNA)
- Digi
Exploit prediction (EPSS)
0.53%
Probability of exploitation in 30 days
45.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper neutralization of special elements used in an OS command ('OS command injection')