Digi IX Family EUVD-2026-91802

Requires network reachability to the affected Digi device's WEB ADMINISTRATION INTERFACE, and per the CVSS vector (AV:A) the attacker must be on an ADJACENT/local network segment rather than exploiting across the open Internet. No authentication and no user interaction are needed (PR:N/UI:N), so a single crafted HTTP POST to the exposed admin web server is sufficient against a default-reachable interface. Primary LIMITING factors: (1) the admin web server must be enabled and reachable - Digi's own mitigation is to disable the web server when not actively configuring the device, which eliminates the attack surface; (2) adjacent-network positioning is required, so segmenting management interfaces onto isolated VLANs/management networks substantially reduces real-world exposure.

This is a serious but not maximally-exposed flaw. The CVSS 4.0 score of 9.4 (CRITICAL) is driven by unauthenticated exploitation (PR:N), no user interaction (UI:N), low complexity (AC:L), and full triad compromise of both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) resulting in root-level OS command execution (CWE-78). The single most important mitigating signal is the attack vector: the vendor-supplied vector specifies AV:A (Adjacent), meaning exploitation requires the attacker to be on the same local/adjacent network segment as the device's web administration interface, NOT arbitrary Internet-wide remote access. NOTE A DISCREPANCY: the prose description reads like a classic remote HTTP attack ('A specially crafted HTTP POST request ... allows an unauthenticated attacker'), yet the CVSS vector constrains this to AV:A - verify with Digi whether the admin interface is reachable only over LAN/management interfaces or whether some deployments expose it more broadly, as this materially changes the blast radius. On exploitation-likelihood signals: there is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. Net assessment: treat as a high-priority patch for any Digi fleet where these devices sit on reachable management or production LANs (industrial/OT environments especially), but the adjacent-only vector means this is not (yet) a mass-scannable Internet worm candidate - prioritize network-reachability review alongside patching.

An attacker who has gained a foothold on the same local or management network as a Digi device (e.g., via a compromised adjacent host, rogue device, or misconfigured OT/IT segment) sends a single specially crafted HTTP POST request to the device's web administration interface. Because no authentication is required and complexity is low, the request injects attacker-controlled input that is executed as operating-system commands with root privileges. No public exploit code is identified at time of analysis, but the low-complexity unauthenticated nature makes weaponization straightforward once the interface is reachable.