EUVD-2026-42047
GHSA-jmv4-p83r-grw3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated bypass with unspecified preconditions (AC:H); no integrity or availability impact described, only confidentiality exposure.
Primary rating from Vendor (Digi).
CVSS VectorVendor: Digi
Lifecycle Timeline
1DescriptionCVE.org
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.
AnalysisAI
Authentication bypass in Digi International PortServer TS 1/2/4 and Digi One SP/SP IA/IA serial device servers permits remote unauthenticated attackers to circumvent authorization controls and access restricted device resources. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms remote, credential-free exploitation but places High Attack Complexity on the flaw, indicating specific preconditions must be met - limiting opportunistic or automated mass exploitation. Impact is strictly confidentiality (C:H/I:N/A:N), meaning successful exploitation exposes restricted data or configuration without enabling modification or service disruption; no public exploit and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
The affected products - Digi International PortServer TS 1/2/4 and Digi One SP/SP IA/IA - are serial-to-IP device servers used in OT and industrial environments to connect legacy RS-232/422/485 serial equipment to Ethernet networks (CPE: cpe:2.3:a:digi_international:portserver_ts_1/2/4:*:*:*:*:*:*:*:* and cpe:2.3:a:digi_international:digi_one_sp_/_sp_ia_/_ia:*:*:*:*:*:*:*:*). The root cause is classified as CWE-863 (Incorrect Authorization): the device performs authorization checks but does so incorrectly, meaning the flaw is not in the authentication handshake itself but in subsequent access-control enforcement. This class of vulnerability typically arises when certain request paths, parameter formats, or timing windows bypass the authorization enforcement point, allowing an unauthenticated request to be treated as having sufficient privilege to reach protected resources. In the context of serial device servers, restricted resources likely include device configuration interfaces, serial port data, and management credentials for connected equipment.
RemediationAI
Consult the Digi International security advisory at https://www.digi.com/resources/security for firmware patches and exact remediated version numbers, as confirmed patched versions are not available in the current data. As immediate compensating controls while awaiting patched firmware, place all PortServer TS and Digi One SP devices behind a network firewall or VPN gateway, permitting access only from trusted management hosts - this directly addresses the AV:N attack vector and substantially raises the bar for exploitation under AC:H conditions. Disable any remote management interfaces (web UI, Telnet, or equivalent) that are not operationally required, reducing the exposed attack surface without affecting serial pass-through functionality. Segment these devices onto isolated OT/management VLANs inaccessible from untrusted networks. Note that network segmentation mitigates exposure but does not remediate the underlying CWE-863 authorization flaw; firmware patching remains the definitive fix.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today