CVE-2023-4299

Published: Aug 31, 2023Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

Affected (21)

Products: Digi: Realport, Connectport Ts 8/16 Firmware, Passport Firmware, Connectport Lts 8/16/32 Firmware, Cm Firmware, Portserver Ts Firmware, Portserver Ts Mei Firmware, Portserver Ts Mei Hardened Firmware, Portserver Ts M Mei Firmware, Portserver Ts P Mei Firmware, One Iap Firmware, One Ia Firmware, One Sp Ia Firmware, One Sp Firmware, Wr31 Firmware, Transport Wr11 Xt Firmware, Wr44 R Firmware, Wr21 Firmware, Connect Es Firmware, Connect Sp Firmware

Digi

20 products

Realport

Connectport Ts 8/16 Firmware

Passport Firmware

Connectport Lts 8/16/32 Firmware

Cm Firmware

Portserver Ts Firmware

Portserver Ts Mei Firmware

Portserver Ts Mei Hardened Firmware

Portserver Ts M Mei Firmware

Portserver Ts P Mei Firmware

Transport Wr11 Xt Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Digi Realport	Up to 1.9-40
Digi Realport	Up to 4.8.488.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Connectport Ts 8/16 Firmware	Before 2.26.2.4

Running on/with	Platform Versions
Digi Connectport Ts 8/16	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Passport Firmware	All versions

Running on/with	Platform Versions
Digi Passport	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Connectport Lts 8/16/32 Firmware	Before 1.4.9

Running on/with	Platform Versions
Digi Connectport Lts 8/16/32	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Cm Firmware	All versions

Running on/with	Platform Versions
Digi Cm	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts Mei Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts Mei	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts Mei Hardened Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts Mei Hardened	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts M Mei Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts M Mei	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Portserver Ts P Mei Firmware	All versions

Running on/with	Platform Versions
Digi Portserver Ts P Mei	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi One Iap Firmware	All versions

Running on/with	Platform Versions
Digi One Iap	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi One Ia Firmware	All versions

Running on/with	Platform Versions
Digi One Ia	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi One Sp Ia Firmware	All versions

Running on/with	Platform Versions
Digi One Sp Ia	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi One Sp Firmware	All versions

Running on/with	Platform Versions
Digi One Sp	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Wr31 Firmware	All versions

Running on/with	Platform Versions
Digi Wr31	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Transport Wr11 Xt Firmware	All versions

Running on/with	Platform Versions
Digi Transport Wr11 Xt	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Wr44 R Firmware	All versions

Running on/with	Platform Versions
Digi Wr44 R	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Wr21 Firmware	All versions

Running on/with	Platform Versions
Digi Wr21	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Connect Es Firmware	Before 2.26.2.4

Running on/with	Platform Versions
Digi Connect Es	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Digi Connect Sp Firmware	All versions

Running on/with	Platform Versions
Digi Connect Sp	All versions

Related CWEs

CWE-836

Use of Password Hash Instead of Password for Authentication

The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

References (4)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf

Source: ics-cert@hq.dhs.gov

Vendor Advisory

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.