CVE-2026-75937
OS Command Injection in Digi Accelerated Linux (DAL OS)
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Affected versions
- Digi International IX Family
From 21.8.24.139 · through 26.7.90.14
- Digi International EX Family
From 21.8.24.139 · through 26.7.90.14
- Digi International TX Family
From 21.8.24.139 · through 26.7.90.14
- Digi International Connect IT Family
From 21.8.24.139 · through 26.7.90.14
- Digi International AnywhereUSB Plus Family
From 21.8.24.139 · through 26.7.90.14
- Digi International Connect EZ Family
From 21.8.24.139 · through 26.7.90.14
- Digi International XBee Hive Gateway
From 21.8.24.139 · through 26.7.90.14
- Digi International XBee Hive Border Router for Wi-SUN
From 21.8.24.139 · through 26.7.90.14
- Digi International Digi 54xx Family
through 21.8.24.139
- Digi International Digi 63xx Family
From 21.8.24.139 · through 22.5.50.66
- Digi International Digi IX14
From 21.8.24.139 · through 22.5.50.62
- Digi International Digi LR54 Family
From 21.8.24.139 · through 23.12.1.56