CVE-2021-35978: Command Injection
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-35978?
CVE-2021-35978 is a vulnerability found in Digi TransPort DR64, SR44 VC74, and WR that allows arbitrary remote command execution with SUPER privileges.
How severe is CVE-2021-35978?
CVE-2021-35978 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2021-35978?
Digi TransPort DR64 Firmware versions up to and including 5.2.4.9, and Digi Transport VC74 Firmware versions up to and including 5.2.4.9 are affected.
How can an attacker exploit CVE-2021-35978?
An attacker with knowledge of the ZING protocol can exploit CVE-2021-35978 to execute arbitrary code on the controller including overwriting firmware or adding/removing users.
Where can I find more information about CVE-2021-35978?
You can find more information about CVE-2021-35978 on the Digi website and in the vulnerability disclosure document available at the provided GitHub link.