8.1

CVE-2023-4299

Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digi ≫ Realport SwPlatform linux Version <= 1.9-40
Digi ≫ Realport SwPlatform windows Version <= 4.8.488.0
Digi ≫ Connectport Ts 8/16 Firmware Version < 2.26.2.4
   Digi ≫ Connectport Ts 8/16 Version -
Digi ≫ Passport Firmware Version -
   Digi ≫ Passport Version -
Digi ≫ Connectport Lts 8/16/32 Firmware Version < 1.4.9
   Digi ≫ Connectport Lts 8/16/32 Version -
Digi ≫ Cm Firmware Version -
   Digi ≫ Cm Version -
Digi ≫ Portserver Ts Firmware Version -
   Digi ≫ Portserver Ts Version -
Digi ≫ Portserver Ts Mei Firmware Version -
   Digi ≫ Portserver Ts Mei Version -
Digi ≫ Portserver Ts M Mei Firmware Version -
   Digi ≫ Portserver Ts M Mei Version -
Digi ≫ Portserver Ts P Mei Firmware Version -
   Digi ≫ Portserver Ts P Mei Version -
Digi ≫ One Iap Firmware Version -
   Digi ≫ One Iap Version -
Digi ≫ One Ia Firmware Version -
   Digi ≫ One Ia Version -
Digi ≫ One Sp Ia Firmware Version -
   Digi ≫ One Sp Ia Version -
Digi ≫ One Sp Firmware Version -
   Digi ≫ One Sp Version -
Digi ≫ Wr31 Firmware Version -
   Digi ≫ Wr31 Version -
Digi ≫ Transport Wr11 Xt Firmware Version -
   Digi ≫ Transport Wr11 Xt Version -
Digi ≫ Wr44 R Firmware Version -
   Digi ≫ Wr44 R Version -
Digi ≫ Wr21 Firmware Version -
   Digi ≫ Wr21 Version -
Digi ≫ Connect Es Firmware Version < 2.26.2.4
   Digi ≫ Connect Es Version -
Digi ≫ Connect Sp Firmware Version -
   Digi ≫ Connect Sp Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.55% 0.419
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
DHS.gov 9 2.2 6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-836 Use of Password Hash Instead of Password for Authentication

The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04
Third Party Advisory
US Government Resource
https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf
Vendor Advisory