CVE-2023-4299: Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-31 · updated 2026-06-17
Weakness: CWE-836

Description

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

Affected products

Digi Cm Firmware: all versions
Digi Connect Es Firmware: before 2.26.2.4 — fixed in 2.26.2.4
Digi Connect Sp Firmware: all versions
Digi Connectport Lts 8/16/32 Firmware: before 1.4.9 — fixed in 1.4.9
Digi Connectport Ts 8/16 Firmware: before 2.26.2.4 — fixed in 2.26.2.4
Digi One Ia Firmware: all versions
Digi One Iap Firmware: all versions
Digi One Sp Firmware: all versions
Digi One Sp Ia Firmware: all versions
Digi Passport Firmware: all versions
Digi Portserver Ts Firmware: all versions
Digi Portserver Ts M Mei Firmware: all versions
Digi Portserver Ts Mei Firmware: all versions
Digi Portserver Ts Mei Hardened Firmware: all versions
Digi Portserver Ts P Mei Firmware: all versions
Digi Realport: through 1.9-40; through 4.8.488.0
Digi Transport Wr11 Xt Firmware: all versions
Digi Wr21 Firmware: all versions
Digi Wr31 Firmware: all versions
Digi Wr44 R Firmware: all versions

How to fix

Upgrade to a fixed version: Digi Connect Es Firmware 2.26.2.4; Digi Connectport Lts 8/16/32 Firmware 1.4.9; Digi Connectport Ts 8/16 Firmware 2.26.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4299 or the next vulnerability affects your stack