Digi International PortServer TS, Digi One SP IA
Summary
CISA has issued an alert regarding multiple vulnerabilities in Digi International's PortServer TS and Digi One SP IA devices. Successful exploitation could allow attackers to bypass authentication, access restricted resources, obtain credentials, and inject malicious scripts. Affected products include various versions of PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA.
IFF Assessment
These vulnerabilities allow attackers to bypass authentication and gain unauthorized access, posing a direct threat to the security of affected industrial control systems.
Severity
Defender Context
Defenders managing Digi International PortServer TS and Digi One SP IA devices should be aware of these vulnerabilities. It is crucial to apply available firmware updates or implement recommended mitigations such as enabling HTTPS or disabling the web server when not in use. These devices often control critical infrastructure, making unauthorized access a serious concern.