CVE-2026-75937: OS Command Injection in Digi Accelerated Linux (DAL OS)

Published Oct 2, 2026

Updated

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Affected Software

1 affected component

Digi Accelerated Linux (DAL OS)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable the web server when not configuring the device.
Digi Accelerated Linux (DAL OS) web server web server = disabled

Event History

Oct 2, 2026

CVE Published

via MITRE·08:33 PM

Data Sourced

via MITRE·08:33 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker able to send a specially crafted HTTP POST request to the device's web administration interface can exploit it. Successful exploitation results in arbitrary operating system commands running with root privileges.

What mitigation is available if the device does not need web-based administration?

Disable the web server when the device is not being configured. This removes access to the affected web administration interface during periods when it is unnecessary.

CVE-2026-75937: OS Command Injection in Digi Accelerated Linux (DAL OS)

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What mitigation is available if the device does not need web-based administration?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What mitigation is available if the device does not need web-based administration?