CVE-2021-35979

Published: Oct 8, 2021Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication.

Affected (19)

Products: Digi: Realport, Connectport Ts 8/16 Firmware, Connectport Lts 8/16/32 Firmware, Passport Integrated Console Server Firmware, Cm Firmware, Portserver Ts Firmware, Portserver Ts Mei Firmware, Portserver Ts Mei Hardened Firmware, Portserver Ts M Mei Firmware, 6350 Sr Firmware, Portserver Ts P Mei Firmware, Transport Wr11 Xt Firmware, One Iap Family Firmware, One Ia Firmware, Wr31 Firmware, Wr44 R Firmware, Connect Es Firmware, Wr21 Firmware

Digi

18 products

Realport

Connectport Ts 8/16 Firmware

Connectport Lts 8/16/32 Firmware

Passport Integrated Console Server Firmware

Cm Firmware

Portserver Ts Firmware

Portserver Ts Mei Firmware

Portserver Ts Mei Hardened Firmware

Portserver Ts M Mei Firmware

6350 Sr Firmware

Portserver Ts P Mei Firmware

Transport Wr11 Xt Firmware

One Iap Family Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Digi Realport	Up to 1.9-40
Digi Realport	Up to 4.8.488.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Connectport Ts 8/16 Firmware	All versions

Running on/with	Platform Versions
Digi Connectport Ts 8/16	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Connectport Lts 8/16/32 Firmware	All versions

Running on/with	Platform Versions
Digi Connectport Lts 8/16/32	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Passport Integrated Console Server Firmware	All versions

Running on/with	Platform Versions
Digi Passport Integrated Console Server	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Cm Firmware	All versions

Running on/with	Platform Versions
Digi Cm	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts Mei Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts Mei	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts Mei Hardened Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts Mei Hardened	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts M Mei Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts M Mei	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi 6350 Sr Firmware	All versions

Running on/with	Platform Versions
Digi 6350 Sr	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts P Mei Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts P Mei	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Transport Wr11 Xt Firmware	All versions

Running on/with	Platform Versions
Digi Transport Wr11 Xt	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi One Iap Family Firmware	All versions

Running on/with	Platform Versions
Digi One Iap Family	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi One Ia Firmware	All versions

Running on/with	Platform Versions
Digi One Ia	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Wr31 Firmware	All versions

Running on/with	Platform Versions
Digi Wr31	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Wr44 R Firmware	All versions

Running on/with	Platform Versions
Digi Wr44 R	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Connect Es Firmware	All versions

Running on/with	Platform Versions
Digi Connect Es	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Wr21 Firmware	All versions

Running on/with	Platform Versions
Digi Wr21	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt

Source: cve@mitre.org

Third Party Advisory

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.