CVE-2021-35978
Estado: ModificadaCrítica (9.8)—
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.68%
- Percentil entre todas las CVEs puntuadas: 89
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
CWE
- CWE-77
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-35978",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-12-10T13:15:07.620",
"references": [
{
"url": "https://digi.com",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://digi.com",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc."
},
{
"lang": "es",
"value": "Se ha detectado un problema en Digi TransPort DR64, SR44 VC74 y WR. El protocolo ZING permite una ejecución arbitraria de comandos remotos con privilegios SUPER. Esto permite a un atacante (con conocimiento del protocolo) ejecutar código arbitrario en el controlador, incluyendo la sobreescritura del firmware, la adición/eliminación de usuarios, la deshabilitación del firewall interno, etc"
}
],
"lastModified": "2026-06-17T03:58:08.427",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_dr64_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52506872-BAFC-4A01-929F-FF5FFF506F8B",
"versionEndIncluding": "5.2.4.9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_dr64:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1AEA8387-7D13-459E-AB57-23623E585F58"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_sr44_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91254B1B-B09F-406A-8CCD-357B585FE812"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_sr44:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5F7CE342-9785-4F57-932D-23650C6E84A2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_vc74_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7BB2FB4-1978-476D-A41E-C6ECE4D08EBA",
"versionEndIncluding": "5.2.4.9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_vc74:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2BDD2C41-D47E-4433-A461-066FB167B042"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_wr11_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66D8D126-5210-4837-A0A2-51E7BA8B85C1",
"versionEndIncluding": "8.2.1.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_wr11:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8CBAC641-0471-4AC1-AB8B-8E56FE3E3333"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_wr11_xt_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1070E773-F522-46F2-B9FE-B7477D78E5B7",
"versionEndIncluding": "8.2.1.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_wr11_xt:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "10850ACB-E28F-4AC7-ABA0-EDFF2D2F9EF6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_wr21_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66B28486-C8C9-42EE-8798-EB01E2AD730E",
"versionEndIncluding": "8.2.1.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_wr21:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "958AC18F-8C58-4BED-9ED7-AAAB722FE8B7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_wr31_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "867CD9A1-BCE3-4627-B4B7-4E3202A55F36",
"versionEndIncluding": "8.2.1.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_wr31:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AC28ABA4-2794-4890-BFDC-416E155AB366"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_wr41_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21F03CF2-89C3-4A3D-9565-4A5F6715A793",
"versionEndIncluding": "5.2.4.6",
"versionStartIncluding": "5.0.0.0"
},
{
"criteria": "cpe:2.3:o:digi:transport_wr41_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B3E5EFF-94F4-4466-9F35-E4B6774BEA75",
"versionEndIncluding": "6.1.3.5",
"versionStartIncluding": "6.0.0.0"
},
{
"criteria": "cpe:2.3:o:digi:transport_wr41_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F9368A8-B92B-47C0-BEAC-7D3EB33D3D85",
"versionEndIncluding": "8.3.1.2",
"versionStartIncluding": "8.0.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_wr41:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D041514D-8E0A-4ABB-AC24-6C716F672390"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_wr44_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3BD94312-4005-43EC-B2FA-F09289C3F078",
"versionEndIncluding": "8.3.1.2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_wr44:v2:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "81F8AF9D-B7B8-4BD7-8BA0-42A18C5EA298"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}