CVE-2026-75937 is a critical vulnerability in the Digi International IX Family device. An unauthenticated attacker can execute arbitrary operating system commands with root privileges via a specially crafted HTTP POST request to the web administration interface. The vendor advises disabling the web server when not configuring the device. This vulnerability allows for potential disruption of critical infra [truncated]
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA. An authenticated administrator can inject script into certain system configuration fields, which executes in the browser of users viewing affected pages. This issue has a CVSS score of 4.8 and is classified as MEDIUM severity. Administrators and user [truncated]
CVE-2026-12352 is an authentication bypass vulnerability in products from Digi. The vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device. The CVE record was published on 2026-07-07T15:16:42.283Z and has not been modified since then. Security teams should assess the vulnerability's impact on their systems, especially if using products from Digi.
