CVE-2021-38412: Digi PortServer TS 16 Improper Authentication
Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If upgrading the Digi PortServer TS 16 is not possible, mitigate the risk by preventing external access to the Digi PortServer TS 16 HTTP/HTTPS and SNMP services (e.g., restrict/ACL firewall access to trusted management hosts only).
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2021-38412.
What is the severity rating of CVE-2021-38412?
The severity rating of CVE-2021-38412 is critical with a rating of 9.8.
Which software is affected by CVE-2021-38412?
The Digi PortServer TS 16 Rack firmware versions 82000684 and 82000685 are affected.
Does CVE-2021-38412 require authentication for exploitation?
No, properly formatted POST requests to the affected resources do not require authentication or authentication tokens.
What can an attacker potentially achieve through CVE-2021-38412?
An attacker could enable the SNMP service and manipulate the community strings.