Xbee Hive Gateway
Monthly
Unauthenticated command injection in the web administration interface of multiple Digi International product families (including IX, EX, TX, Connect IT, AnywhereUSB Plus, Connect EZ, XBee Hive, Digi 54xx/63xx, and Digi LR54) allows an attacker on an adjacent network segment to execute arbitrary operating system commands with root privileges via a crafted HTTP POST. The flaw is rated CVSS 9.4 (CVSS 4.0) and requires no authentication or user interaction; the independent assessment confirms AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H on CVSS 3.1. No public exploit code or CISA KEV active exploitation is identified in the supplied data, and the main limiting factors are that the admin web server must be enabled and reachable, and the attacker must be adjacent to the device rather than exploiting across the open internet.
Unauthenticated command injection in the web administration interface of multiple Digi International product families (including IX, EX, TX, Connect IT, AnywhereUSB Plus, Connect EZ, XBee Hive, Digi 54xx/63xx, and Digi LR54) allows an attacker on an adjacent network segment to execute arbitrary operating system commands with root privileges via a crafted HTTP POST. The flaw is rated CVSS 9.4 (CVSS 4.0) and requires no authentication or user interaction; the independent assessment confirms AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H on CVSS 3.1. No public exploit code or CISA KEV active exploitation is identified in the supplied data, and the main limiting factors are that the admin web server must be enabled and reachable, and the attacker must be adjacent to the device rather than exploiting across the open internet.