by Kastro
Paper/Archive/CVE-2026-75937

CVE-2026-75937

Digi International IX Family — OS Command Injection in Digi Accelerated Linux (DAL OS)

EPSS 0.5%CVSS 9.4
critical.is priorityof 100
37
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 45.3.453 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Affected

ProductAffectedFixed inSource
IX Family21.8.24.139 – 26.7.90.14–CNA
EX Family21.8.24.139 – 26.7.90.14–CNA
TX Family21.8.24.139 – 26.7.90.14–CNA
Connect IT Family21.8.24.139 – 26.7.90.14–CNA
AnywhereUSB Plus Family21.8.24.139 – 26.7.90.14–CNA
Connect EZ Family21.8.24.139 – 26.7.90.14–CNA
XBee Hive Gateway21.8.24.139 – 26.7.90.14–CNA
XBee Hive Border Router for Wi-SUN21.8.24.139 – 26.7.90.14–CNA
Digi 54xx Family≤ 21.8.24.139–CNA
Digi 63xx Family21.8.24.139 – 22.5.50.66–CNA
Digi IX1421.8.24.139 – 22.5.50.62–CNA
Digi LR54 Family21.8.24.139 – 23.12.1.56–CNA

Scores by source

Digi (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorydigi.com/resources/security