CVE-2026-75937: OS Command Injection in Digi Accelerated Linux (DAL OS)
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the web server when not configuring the device.
Digi Accelerated Linux (DAL OS) web server web server = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker able to send a specially crafted HTTP POST request to the device's web administration interface can exploit it. Successful exploitation results in arbitrary operating system commands running with root privileges.
What mitigation is available if the device does not need web-based administration?
Disable the web server when the device is not being configured. This removes access to the affected web administration interface during periods when it is unnecessary.