EUVD-2026-42048
GHSA-vr57-6xgh-64rf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Administrator credentials required (PR:H), victim must load page (UI:R), XSS crosses into victim browser scope (S:C); no availability impact applies.
Primary rating from Vendor (Digi).
CVSS VectorVendor: Digi
Lifecycle Timeline
1DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).
AnalysisAI
Stored cross-site scripting in the web management interfaces of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA serial device servers allows a remote, authenticated administrator to persist malicious script payloads in system configuration fields. The injected script executes in the browser of any user who subsequently views the affected configuration pages, enabling session hijacking, credential theft, or UI redress attacks against those users. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.8 reflects the high-privilege prerequisite that meaningfully constrains real-world risk.
Technical ContextAI
The affected products are Digi International serial device servers - network-attached appliances that bridge legacy serial (RS-232/422/485) peripherals to TCP/IP networks, commonly deployed in industrial, operational technology (OT), and infrastructure environments. The vulnerability resides in the HTTP-based web management interface embedded in firmware across four product lines: Digi PortServer TS (cpe:2.3:a:digi_international:digi_portserver_ts), Digi One SP (cpe:2.3:a:digi_international:digi_one_sp), Digi One SP IA (cpe:2.3:a:digi_international:digi_one_sp_ia), and Digi One IA (cpe:2.3:a:digi_international:digi_one_ia). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: user-supplied input written to system configuration fields is later reflected into rendered HTML without adequate output encoding or content-security controls, allowing injected JavaScript to execute in victim browsers. The wildcard CPE versions (*) indicate no specific firmware version range has been published, meaning all deployed firmware may be affected.
RemediationAI
The primary remediation is to apply any firmware update issued by Digi International for the affected device lines; consult https://www.digi.com/resources/security for the latest advisories, as no specific patched firmware version number was available in the source data at time of analysis. Because the vulnerability requires an authenticated administrator to inject the payload, restricting administrative access to the web management interface is an effective compensating control: limit access to the management interface to a dedicated, isolated management VLAN or use firewall rules to block port 80/443 on the device's management interface from untrusted network segments, accepting the trade-off of reduced remote manageability. Additionally, enforce multi-factor authentication for administrative accounts where the device supports it, and audit administrator account lists to minimize the number of principals capable of triggering the injection. Users viewing configuration pages should operate management sessions in isolated browser profiles to reduce session-hijacking impact if a payload is encountered.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today