CVE-2023-4299: Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication

Reference Links

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04 (Advisory)
• https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-23-243-04

Frequently Asked Questions

• What is the vulnerability ID of this vulnerability?

  The vulnerability ID of this vulnerability is CVE-2023-4299.

• What is the severity level of CVE-2023-4299?

  The severity level of CVE-2023-4299 is critical, with a severity value of 8.1.

• What is the affected software of CVE-2023-4299?

  The affected software of CVE-2023-4299 includes Digi RealPort Protocol, Digi Connectport Ts 8/16 Firmware, Digi Connectport Lts 8/16/32 Firmware, Digi Cm Firmware, Digi Portserver Ts Firmware, Digi Portserver Ts Mei Firmware, Digi Portserver Ts Mei Hardened Firmware, Digi Portserver Ts M Mei Firmware, Digi Portserver Ts P Mei Firmware, Digi One Iap Firmware, Digi One Ia Firmware, Digi One Sp Ia Firmware, Digi One Sp Firmware, Digi Wr31 Firmware, Digi Transport Wr11 Xt Firmware, Digi Wr44 R Firmware, Digi Wr21 Firmware, Digi Connect Es Firmware, and Digi Connect Sp Firmware.

• How does the vulnerability impact the affected software?

  The vulnerability allows an attacker to perform a replay attack and bypass authentication to access connected equipment.

• Where can I find more information about CVE-2023-4299?

  You can find more information about CVE-2023-4299 at the following references: [Reference 1](https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04), [Reference 2](https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf).