by Kastro
Paper/Archive/CVE-2023-4299

CVE-2023-4299

Digi International Digi RealPort — Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication

EPSS 0.7%CVSS 9.0
critical.is priorityof 100
38
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 52.4.524 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

Affected

ProductAffectedFixed inSource
Digi RealPort≤ 4.8.488.0–CNA
Digi RealPort≤ 1.9-40–CNA
Digi ConnectPort TS 8/16< 2.26.2.42.26.2.4CNA
Digi Passport Console Serverall versions–CNA
Digi ConnectPort LTS 8/16/32< 1.4.91.4.9CNA
Digi CM Console Serverall versions–CNA
Digi PortServer TSall versions–CNA
Digi PortServer TS MEIall versions–CNA
Digi PortServer TS MEI Hardenedall versions–CNA
Digi PortServer TS M MEIall versions–CNA
Digi PortServer TS P MEIall versions–CNA
Digi One IAP Familyall versions–CNA

Scores by source

icscert (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-243-04refdigi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf