CVE-2021-36767: Critical severity digi realport vulnerability
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.
Affected Software
Event History
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2021-36767.
What is the severity of CVE-2021-36767?
The severity of CVE-2021-36767 is critical with a CVSS score of 9.8.
Which software is affected by CVE-2021-36767?
Digi RealPort versions up to 4.10.490 on Linux and Windows are affected by CVE-2021-36767.
How does authentication work in Digi RealPort through 4.10.490?
Authentication in Digi RealPort through 4.10.490 relies on a challenge-response mechanism.
How can an attacker exploit CVE-2021-36767?
An attacker can send an unauthenticated request to the server to exploit CVE-2021-36767.