What’s Vulnerable › Vulnerabilities

CVE-2021-35978

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-10 · updated 2026-06-17
• Weakness: CWE-77

Description

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.

Affected products

• Digi Transport Dr64 Firmware: through 5.2.4.9
• Digi Transport Sr44 Firmware: all versions
• Digi Transport Vc74 Firmware: through 5.2.4.9
• Digi Transport Wr11 Firmware: through 8.2.1.3
• Digi Transport Wr11 Xt Firmware: through 8.2.1.3
• Digi Transport Wr21 Firmware: through 8.2.1.3
• Digi Transport Wr31 Firmware: through 8.2.1.3
• Digi Transport Wr41 Firmware: from 5.0.0.0 through 5.2.4.6; from 6.0.0.0 through 6.1.3.5; from 8.0.0.0 through 8.3.1.2
• Digi Transport Wr44 Firmware: through 8.3.1.2

References

• https://digi.com
• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
• https://digi.com
• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt

Get alerted when CVE-2021-35978 or the next vulnerability affects your stack