CVE-2026-12948 Digi International CVE debrief

Who should care

Administrators and users of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA devices should be aware of this vulnerability and take steps to mitigate it. Affected operators, platform administrators, vulnerability management teams, and security teams should review the CVE record and NVD entry for further information.

Technical summary

The vulnerability is a stored cross-site scripting (XSS) issue in the web management interface of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA. An authenticated administrator can inject malicious script into certain system configuration fields. When a user views the affected pages, the script executes in their browser. The CVE record indicates a CVSS score of 4.8 and a MEDIUM severity level. Affected product deployments should be reviewed for exposure, and administrators should apply vendor patches or updates when available, implement additional security controls such as input validation and output encoding, and monitor for suspicious activity.

Defensive priority

Medium priority due to the requirement for authentication and the potential impact of XSS.

Recommended defensive actions

• Apply vendor patches or updates when available
• Implement additional security controls, such as input validation and output encoding
• Monitor for suspicious activity and implement incident response plans
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-07T15:16:42.413Z and last modified on 2026-07-07T16:16:37.780Z. The NVD entry is currently in the 'Received' status. Evidence is limited, and defenders should verify affected scope and vendor guidance. Additional review is required to confirm impacted deployments and validate mitigations.

Official resources