8.8

CVE-2021-37188

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware (because the bootloader does not verify that it is authentic), changing the behavior of the gateway.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digi ≫ Transport Dr64 Firmware Version <= 5.2.4.9
   Digi ≫ Transport Dr64 Version -
Digi ≫ Transport Dr64 Firmware Version -
   Digi ≫ Transport Sr44 Version -
Digi ≫ Transport Vc74 Firmware Version <= 5.2.4.9
   Digi ≫ Transport Vc74 Version -
Digi ≫ Transport Wr11 Firmware Version <= 8.2.1.3
   Digi ≫ Transport Wr11 Version -
Digi ≫ Transport Wr11 Xt Firmware Version <= 8.2.1.3
   Digi ≫ Transport Wr11 Xt Version -
Digi ≫ Transport Wr21 Firmware Version <= 8.2.1.3
   Digi ≫ Transport Wr21 Version -
Digi ≫ Transport Wr31 Firmware Version <= 8.2.1.3
   Digi ≫ Transport Wr31 Version -
Digi ≫ Transport Wr41 Firmware Version >= 5.0.0.0 <= 5.2.4.6
   Digi ≫ Transport Wr41 Version -
Digi ≫ Transport Wr41 Firmware Version >= 6.0.0.0 <= 6.1.3.5
   Digi ≫ Transport Wr41 Version -
Digi ≫ Transport Wr41 Firmware Version >= 8.0.0.0 <= 8.3.1.2
   Digi ≫ Transport Wr41 Version -
Digi ≫ Transport Wr44 Firmware Version <= 8.3.1.2
   Digi ≫ Transport Wr44 Version v2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.366
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
Third Party Advisory
https://www.digi.com/search/results?q=transport
Vendor Advisory