CVE-2021-35978: Command Injection
First published: Fri Dec 10 2021(Updated: )
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Digi Transport | <=5.2.4.9 | |
| Digi Transport Dr64 Firmware | ||
| Digi Transport | ||
| Digi Transport | ||
| Digi Transport | <=5.2.4.9 | |
| Digi Transport | ||
| Digi Transport WR11 Firmware | <=8.2.1.3 | |
| Digi Transport | ||
| Digi Transport Wr11 Firmware | <=8.2.1.3 | |
| Digi Transport | ||
| Digi WR21 | <=8.2.1.3 | |
| Digi WR21 | ||
| Digi WR31 Firmware | <=8.2.1.3 | |
| Digi Transport | ||
| Digi Transport | >=5.0.0.0<=5.2.4.6 | |
| Digi Transport | >=6.0.0.0<=6.1.3.5 | |
| Digi Transport | >=8.0.0.0<=8.3.1.2 | |
| Digi Transport | ||
| Digi WR44 R | <=8.3.1.2 | |
| Digi Transport | =v2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-35978?
CVE-2021-35978 is a vulnerability found in Digi TransPort DR64, SR44 VC74, and WR that allows arbitrary remote command execution with SUPER privileges.
How severe is CVE-2021-35978?
CVE-2021-35978 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2021-35978?
Digi TransPort DR64 Firmware versions up to and including 5.2.4.9, and Digi Transport VC74 Firmware versions up to and including 5.2.4.9 are affected.
How can an attacker exploit CVE-2021-35978?
An attacker with knowledge of the ZING protocol can exploit CVE-2021-35978 to execute arbitrary code on the controller including overwriting firmware or adding/removing users.
Where can I find more information about CVE-2021-35978?
You can find more information about CVE-2021-35978 on the Digi website and in the vulnerability disclosure document available at the provided GitHub link.
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/digi
- canonical/digi transport
- version/digi transport/5.2.4.9
- canonical/digi transport dr64 firmware
- canonical/digi transport wr11 firmware
- version/digi transport wr11 firmware/8.2.1.3
- canonical/digi wr21
- version/digi wr21/8.2.1.3
- canonical/digi wr31 firmware
- version/digi wr31 firmware/8.2.1.3
- version/digi transport/5.0.0.0
- version/digi transport/5.2.4.6
- version/digi transport/6.0.0.0
- version/digi transport/6.1.3.5
- version/digi transport/8.0.0.0
- version/digi transport/8.3.1.2
- canonical/digi wr44 r
- version/digi wr44 r/8.3.1.2
- version/digi transport/v2