CVE-2026-12948: Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 4.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-07 · updated 2026-07-13
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).

Affected products

Digi International Digi One IA: from 82000774_Z through 82000774_AB
Digi International Digi One SP: from 82000774_Z through 82000774_AB
Digi International Digi One SP IA: from 82000774_Z through 82000774_AB
Digi International Digi PortServer TS: from 82000747_V1 through 82000747_AB

References

https://www.digi.com/resources/security

Get alerted when CVE-2026-12948 or the next vulnerability affects your stack