CVE-2021-37189: High severity digi transport wr11 firmware vulnerability
An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-37189?
CVE-2021-37189 is a vulnerability found on Digi TransPort Gateway devices through 5.2.13.4 where they do not set the Secure attribute for sensitive cookies in HTTPS sessions, potentially compromising the security of user data.
What is the severity of CVE-2021-37189?
The severity of CVE-2021-37189 is high with a CVSS score of 7.5.
How can CVE-2021-37189 be exploited?
CVE-2021-37189 can be exploited by intercepting and reading sensitive cookies sent over an HTTP session, as the Secure attribute is not set.
What is the affected software for CVE-2021-37189?
The affected software for CVE-2021-37189 includes Digi Transport Wr11 Firmware, Digi Transport Wr11 Xt Firmware, Digi Transport Wr21 Firmware, Digi Transport Wr31 Firmware, Digi Transport Wr41 Firmware, and Digi Transport Wr44 Firmware.
How can I mitigate the vulnerability CVE-2021-37189?
To mitigate CVE-2021-37189, it is recommended to update Digi TransPort Gateway devices to version 6.0.0.0 or higher, where the Secure attribute is properly set for sensitive cookies.