CVE-2021-36767: digi realport

Vulnerability summary

CVE-2021-36767 is a critical (CVSS 9.8) vulnerability in digi realport. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.7% of scored vulnerabilities.

Timeline

1. 08-10-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.

• CWE-916Use of Password Hash With Insufficient Computational EffortThe product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.