What’s Vulnerable › Vulnerabilities
CVE-2026-75937: OS Command Injection in Digi Accelerated Linux (DAL OS)
- Severity: critical (CVSS 9.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-02 · updated 2026-10-06
- Weakness: CWE-78
Description
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Affected products
- Digi International AnywhereUSB Plus Family: from 21.8.24.139 through 26.7.90.14
- Digi International Connect EZ Family: from 21.8.24.139 through 26.7.90.14
- Digi International Connect IT Family: from 21.8.24.139 through 26.7.90.14
- Digi International Digi 54xx Family: through 21.8.24.139
- Digi International Digi 63xx Family: from 21.8.24.139 through 22.5.50.66
- Digi International Digi IX14: from 21.8.24.139 through 22.5.50.62
- Digi International Digi LR54 Family: from 21.8.24.139 through 23.12.1.56
- Digi International EX Family: from 21.8.24.139 through 26.7.90.14
- Digi International IX Family: from 21.8.24.139 through 26.7.90.14
- Digi International TX Family: from 21.8.24.139 through 26.7.90.14
- Digi International XBee Hive Border Router for Wi-SUN: from 21.8.24.139 through 26.7.90.14
- Digi International XBee Hive Gateway: from 21.8.24.139 through 26.7.90.14
References
Get alerted when CVE-2026-75937 or the next vulnerability affects your stack