CVE-2021-38412: Digi PortServer TS 16 Improper Authentication
First published: Fri Sep 17 2021(Updated: )
Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Digi Portserver Ts 16 Firmware | =82000684 | |
| Digi Portserver Ts 16 Firmware | =82000685 | |
| Digi PortServer TS 16 | ||
| Digi International, Inc. Firmware Version 82000684 |
Remedy
The PortServer TS 16 product was discontinued in 2016. Per Digi’s security support, the device software and hardware support of 5 years has passed. Digi recommends upgrading to a new supported product. If this is not possible, extended support may be available by contacting Digi directly.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2021-38412.
What is the severity rating of CVE-2021-38412?
The severity rating of CVE-2021-38412 is critical with a rating of 9.8.
Which software is affected by CVE-2021-38412?
The Digi PortServer TS 16 Rack firmware versions 82000684 and 82000685 are affected.
Does CVE-2021-38412 require authentication for exploitation?
No, properly formatted POST requests to the affected resources do not require authentication or authentication tokens.
What can an attacker potentially achieve through CVE-2021-38412?
An attacker could enable the SNMP service and manipulate the community strings.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/remedy
- agent/author
- agent/title
- agent/description
- agent/severity
- agent/references
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/digi
- canonical/digi portserver ts 16 firmware
- version/digi portserver ts 16 firmware/82000684
- version/digi portserver ts 16 firmware/82000685
- canonical/digi portserver ts 16
- vendor/digi international, inc.
- canonical/digi international, inc. firmware version 82000684
- canonical/digi international, inc. firmware version 82000685