CVE-2025-3659: Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
Digi PortServer TS - prior to and including 82000747AA, build date 06/17/2022
Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774Z, build date 10/19/2020
Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3659?
CVE-2025-3659 has a critical severity rating due to improper authentication handling in affected devices.
How do I fix CVE-2025-3659?
To fix CVE-2025-3659, upgrade your Digi PortServer TS or Digi One product to the latest firmware version provided by the vendor.
Which products are affected by CVE-2025-3659?
CVE-2025-3659 affects Digi PortServer TS and Digi One families, specifically models up to certain specified versions.
What are the implications of CVE-2025-3659 if left unpatched?
If left unpatched, CVE-2025-3659 could allow unauthorized access to the affected devices, compromising data integrity and availability.
Is CVE-2025-3659 exploitable remotely?
Yes, CVE-2025-3659 can be exploited remotely due to its nature of improper handling of HTTP POST requests.