CVE-2025-3659

May 12, 2025, 9:15 p.m.

9.4
Critical

Description

Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022 * Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020 * Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020 A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.

Product(s) Impacted

Vendor Product Versions
Digi
  • Digi Portserver Ts
  • Digi One Sp
  • Digi One Ia
  • Digi One Iap
  • *
  • *
  • *
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a digi digi_portserver_ts / 82000747_AA / / / / / /
a digi digi_one_sp / 82000774_Z / / / / / /
a digi digi_one_ia / 82000774_Z / / / / / /
a digi digi_one_iap / 82000770_Z / / / / / /

References

https://hub.digi.com/support/products/infrastructure-management/digi-one-iap-haz/
https://hub.digi.com/support/products/infrastructure-management/digi-one-sp-ia/
https://hub.digi.com/support/products/infrastructure-management/digi-portserver-ts/
https://www.digi.com/getattachment/Resources/Security/Alerts/Improper-authentication-handling-for-Digi-PortServ/improper-authentication-handling.pdf

Tags

CWE-287
2025-05-12
CVE-2025-3659
e8a6bb0b-e373-42b1-a5de-93e314325576

CVSS Score

9.4 / 10

CVSS Data - 4.0

  • Attack Vector: ADJACENT
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: May 12, 2025, 9:15 p.m.
Last Modified: May 12, 2025, 9:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

e8a6bb0b-e373-42b1-a5de-93e314325576

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.