CVE-2021-38412: digi international portserver ts 16 Improper Authentication
Vulnerability summary
CVE-2021-38412 is a critical (CVSS 9.8) Improper Authentication vulnerability in digi international portserver ts 16. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 70.8% of scored vulnerabilities.
Timeline
- 17-09-2021PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA9.6CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LDiffers
EPSS trend
Probability
1.34%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.34% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Digi1 product
- portserver_ts_16_firmware82000684 | 82000685
Digi international1 product
- portserver ts 16≥ Firmware, ≤ 82000684
2 vendors · 2 products
References
1 links
us-cert.cisa.gov/ics/advisories/icsa-21-257-01X Refsource MISCThird Party AdvisoryUS Government Resource