What’s Vulnerable › Vulnerabilities

CVE-2021-36767

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-08 · updated 2026-06-17
• Weakness: CWE-916

Description

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.

Affected products

• Digi 6350-Sr Firmware: all versions
• Digi Cm Firmware: all versions
• Digi Connect Es Firmware: all versions
• Digi Connectport Lts 8/16/32 Firmware: all versions
• Digi Connectport Ts 8/16 Firmware: all versions
• Digi One Ia Firmware: all versions
• Digi One Iap Firmware: all versions
• Digi One Iap Haz Firmware: all versions
• Digi Passport Integrated Console Server Firmware: all versions
• Digi Portserver Ts Firmware: all versions
• Digi Portserver Ts M Mei Firmware: all versions
• Digi Portserver Ts Mei Firmware: all versions
• Digi Portserver Ts Mei Hardened Firmware: all versions
• Digi Portserver Ts P Mei Firmware: all versions
• Digi Realport: through 1.9-40; through 4.10.490
• Digi Transport Wr11 Xt Firmware: all versions
• Digi Wr21 Firmware: all versions
• Digi Wr31 Firmware: all versions
• Digi Wr44 R Firmware: all versions

References

• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt
• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt

Get alerted when CVE-2021-36767 or the next vulnerability affects your stack