CVE-2021-36767
Estado: ModificadaCrítica (9.8)—
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.69%
- Percentil entre todas las CVEs puntuadas: 51
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (19)
Digi — 6350-sr FirmwareDigi — CM FirmwareDigi — Connect ES FirmwareDigi — Connectport LTS 8/16/32 FirmwareDigi — Connectport TS 8/16 FirmwareDigi — ONE IA FirmwareDigi — ONE IAP FirmwareDigi — ONE IAP HAZ FirmwareDigi — Passport Integrated Console Server FirmwareDigi — Portserver TS FirmwareDigi — Portserver TS M MEI FirmwareDigi — Portserver TS MEI FirmwareDigi — Portserver TS MEI Hardened FirmwareDigi — Portserver TS P MEI FirmwareDigi — RealportDigi — Transport Wr11 XT FirmwareDigi — Wr21 FirmwareDigi — Wr31 FirmwareDigi — Wr44 R Firmware
CWE
- CWE-916
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-36767",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-10-08T15:15:09.037",
"references": [
{
"url": "https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-916"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server."
},
{
"lang": "es",
"value": "En Digi RealPort hasta la versión 4.10.490, la autenticación se basa en un mecanismo de desafío-respuesta que da acceso a la contraseña del servidor, lo que hace que la protección sea ineficaz. Un atacante puede enviar una solicitud no autenticada al servidor. El servidor responderá con una versión débilmente codificada de la contraseña de acceso al servidor. El atacante puede entonces descifrar este hash fuera de línea con el fin de iniciar sesión con éxito en el servidor"
}
],
"lastModified": "2026-06-17T03:59:08.037",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:digi:realport:*:*:*:*:*:linux:*:*",
"vulnerable": true,
"matchCriteriaId": "D59A75BB-9159-4631-BC71-39969604EB41",
"versionEndIncluding": "1.9-40"
},
{
"criteria": "cpe:2.3:a:digi:realport:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "E2542E98-F70D-4208-948A-BD69E7A29BA5",
"versionEndIncluding": "4.10.490"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:connectport_ts_8\\/16_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF9EA753-1CAC-4A67-B856-3C10C5B4B46D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:connectport_ts_8\\/16:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E90551D8-A6FF-40EE-BE92-C60D3CCF9FD6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:connectport_lts_8\\/16\\/32_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61EB8CA2-2B8B-454B-A626-F62D0FE5CD9A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:connectport_lts_8\\/16\\/32:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E0620D1B-2856-4EDC-9BD4-F450375EF2B6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:passport_integrated_console_server_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2115058-245C-4FF7-97BB-67BA9C109B0D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:passport_integrated_console_server:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "445C5BA3-6733-40C8-B895-D9AED69F6825"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:cm_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC630FB9-26EE-4287-A140-9C29D583E672"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:cm:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1A9DDFA4-8F21-47E4-97D0-3B135072E273"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:portserver_ts_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D816746-F642-49BE-8C29-FCC39FB9684A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:portserver_ts:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FE6377CC-097B-4775-9964-338A3CFA87CA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:portserver_ts_mei_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DAFB437A-6204-43CF-8567-6B271C8A6A53"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:portserver_ts_mei:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C8206DA8-2823-4116-9E76-975C9A3F2EF7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:portserver_ts_mei_hardened_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5ED9E7D9-03F9-4707-9A84-B94F4B47C940"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:portserver_ts_mei_hardened:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "817E2152-5A72-4B88-A1A1-8CFEFA134979"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:portserver_ts_m_mei_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04BA6165-F33E-4D34-A4E2-B658601A87F8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:portserver_ts_m_mei:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8FC7BF4B-3C56-44B2-8933-E24ACCA000E1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:6350-sr_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77B38406-6CF6-4E03-8637-E3A34E652887"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:6350-sr:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "511A91D4-E530-4DAB-8D27-1171D3580DC5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:portserver_ts_p_mei_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E98CE064-C7CE-44BB-867F-C1589BF53FA5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:portserver_ts_p_mei:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C711FEFA-0A37-4B97-AAC0-D0330D9F5E55"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:transport_wr11_xt_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D678EC7F-5B4F-4CE5-83EE-8BB496011D02"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:transport_wr11_xt:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "10850ACB-E28F-4AC7-ABA0-EDFF2D2F9EF6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:one_ia_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E04D204A-CEA9-4A2C-9E08-6315007384B0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:one_ia:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7BE8C4FB-9DB5-4A32-8EFC-69B746BF2E33"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:wr31_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED6848D4-90FB-4916-B5FF-7194BE75041E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:wr31:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A9F02872-5C53-419B-902C-4906E546C8B7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:wr44_r_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED26070C-69AD-4549-9F13-9FF7AA3B3AFF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:wr44_r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8F5E08FD-5872-4E42-BDA7-2B15CF49C06D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:connect_es_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70664D1E-6E97-488E-BF8E-4C36C02D162B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:connect_es:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7EF02532-005E-4246-AA51-DAC2EA1726FF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:wr21_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2BE2DA9-A83A-48FA-A3BB-0E8E2FCB959C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:wr21:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3EC0E5E9-FBFE-4C99-9C68-6322B255BE88"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:one_iap_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01C62882-7FFC-433F-A7B6-391C1556B014"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:one_iap:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0CF501FC-E102-4D8D-A2B7-6F9D0F444959"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:digi:one_iap_haz_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6FBD34A8-00DE-4D4B-A018-1863690449E5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digi:one_iap_haz:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "87EFFFBB-DBE5-43D2-AFBE-661F942B745C"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}