CVE-2021-36767
First published: Fri Oct 08 2021(Updated: )
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Digi RealPort | <=1.9-40 | |
| Digi RealPort | <=4.10.490 | |
| Digi Connectport Ts 8/16 Firmware | ||
| Digi Connectport Ts 8/16 | ||
| Digi Connectport LTS 8/16/32 Firmware | ||
| Digi ConnectPort LTS 8/16/32 | ||
| Digi Passport | ||
| Digi Passport Integrated Console Server Firmware | ||
| Digi Cm | ||
| Digi Cm Firmware | ||
| Digi PortServer TS Firmware | ||
| Digi PortServer TS | ||
| Digi PortServer TS MEI Firmware | ||
| Digi PortServer TS MEI | ||
| Digi Portserver TS MEI Hardened Firmware | ||
| Digi Portserver TS MEI Hardened Firmware | ||
| Digi PortServer TS MEI Firmware | ||
| Digi PortServer TS MEI | ||
| Digi 6350-SR | ||
| Digi 6350-SR Firmware | ||
| Digi PortServer TS P MEI Firmware | ||
| Digi PortServer TS MEI | ||
| Digi Transport Wr11 Firmware | ||
| Digi Transport | ||
| Digi One IA | ||
| Digi One Iap Firmware | ||
| Digi WR31 Firmware | ||
| Digi WR31 Firmware | ||
| Digi Transport WR44 Firmware | ||
| Digi WR44 R Firmware | ||
| Digi Connect ES | ||
| Digi Connect ES | ||
| Digi WR21 | ||
| Digi TransPort WR21 | ||
| Digi One IA | ||
| Digi One Sp Ia Firmware | ||
| Digi One Iap Haz | ||
| Digi One IAP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2021-36767.
What is the severity of CVE-2021-36767?
The severity of CVE-2021-36767 is critical with a CVSS score of 9.8.
Which software is affected by CVE-2021-36767?
Digi RealPort versions up to 4.10.490 on Linux and Windows are affected by CVE-2021-36767.
How does authentication work in Digi RealPort through 4.10.490?
Authentication in Digi RealPort through 4.10.490 relies on a challenge-response mechanism.
How can an attacker exploit CVE-2021-36767?
An attacker can send an unauthenticated request to the server to exploit CVE-2021-36767.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/digi
- canonical/digi realport
- version/digi realport/1.9-40
- version/digi realport/4.10.490
- canonical/digi connectport ts 8/16 firmware
- canonical/digi connectport ts 8/16
- canonical/digi connectport lts 8/16/32 firmware
- canonical/digi connectport lts 8/16/32
- canonical/digi passport
- canonical/digi passport integrated console server firmware
- canonical/digi cm
- canonical/digi cm firmware
- canonical/digi portserver ts firmware
- canonical/digi portserver ts
- canonical/digi portserver ts mei firmware
- canonical/digi portserver ts mei
- canonical/digi portserver ts mei hardened firmware
- canonical/digi 6350-sr
- canonical/digi 6350-sr firmware
- canonical/digi portserver ts p mei firmware
- canonical/digi transport wr11 firmware
- canonical/digi transport
- canonical/digi one ia
- canonical/digi one iap firmware
- canonical/digi wr31 firmware
- canonical/digi transport wr44 firmware
- canonical/digi wr44 r firmware
- canonical/digi connect es
- canonical/digi wr21
- canonical/digi transport wr21
- canonical/digi one sp ia firmware
- canonical/digi one iap haz
- canonical/digi one iap