CVE-2023-4299: Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-4299.
What is the severity level of CVE-2023-4299?
The severity level of CVE-2023-4299 is critical, with a severity value of 8.1.
What is the affected software of CVE-2023-4299?
The affected software of CVE-2023-4299 includes Digi RealPort Protocol, Digi Connectport Ts 8/16 Firmware, Digi Connectport Lts 8/16/32 Firmware, Digi Cm Firmware, Digi Portserver Ts Firmware, Digi Portserver Ts Mei Firmware, Digi Portserver Ts Mei Hardened Firmware, Digi Portserver Ts M Mei Firmware, Digi Portserver Ts P Mei Firmware, Digi One Iap Firmware, Digi One Ia Firmware, Digi One Sp Ia Firmware, Digi One Sp Firmware, Digi Wr31 Firmware, Digi Transport Wr11 Xt Firmware, Digi Wr44 R Firmware, Digi Wr21 Firmware, Digi Connect Es Firmware, and Digi Connect Sp Firmware.
How does the vulnerability impact the affected software?
The vulnerability allows an attacker to perform a replay attack and bypass authentication to access connected equipment.
Where can I find more information about CVE-2023-4299?
You can find more information about CVE-2023-4299 at the following references: [Reference 1](https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04), [Reference 2](https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf).