What’s Vulnerable › Vulnerabilities

CVE-2021-37189

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-10 · updated 2026-06-17
• Weakness: CWE-311

Description

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

Affected products

• Digi Transport Wr11 Firmware: before 6.0.0.0 — fixed in 6.0.0.0
• Digi Transport Wr11 Xt Firmware: before 6.0.0.0 — fixed in 6.0.0.0
• Digi Transport Wr21 Firmware: before 6.0.0.0 — fixed in 6.0.0.0
• Digi Transport Wr31 Firmware: before 6.0.0.0 — fixed in 6.0.0.0
• Digi Transport Wr41 Firmware: before 6.0.0.0 — fixed in 6.0.0.0
• Digi Transport Wr44 Firmware: before 6.0.0.0 — fixed in 6.0.0.0

How to fix

Upgrade to a fixed version: Digi Transport Wr11 Firmware 6.0.0.0; Digi Transport Wr11 Xt Firmware 6.0.0.0; Digi Transport Wr21 Firmware 6.0.0.0; Digi Transport Wr31 Firmware 6.0.0.0; Digi Transport Wr41 Firmware 6.0.0.0; Digi Transport Wr44 Firmware 6.0.0.0. Check the vendor advisory for mitigations.

References

• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
• https://www.digi.com/search/results?q=transport
• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
• https://www.digi.com/search/results?q=transport

Get alerted when CVE-2021-37189 or the next vulnerability affects your stack