{"schemaVersion":3,"id":"CVE-2026-75937","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.","dates":{"published":"2026-10-02T20:33:56.823Z","modified":"2026-10-03T15:52:55.213Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.4,"severity":"critical","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.4,"severity":"critical","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":9.4,"severity":"critical","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00528,"percentile":0.4356,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-03T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00528,"percentile":0.4356}],"last30":[{"date":"2026-10-03T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00528,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00528,"percentile":0.4356}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"digi international","product":"anywhereusb plus family","name":"AnywhereUSB Plus Family","label":"anywhereusb plus family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/anywhereusb_plus_family"},{"vendor":"digi international","product":"connect ez family","name":"Connect EZ Family","label":"connect ez family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/connect_ez_family"},{"vendor":"digi international","product":"connect it family","name":"Connect IT Family","label":"connect it family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/connect_it_family"},{"vendor":"digi international","product":"digi 54xx family","name":"Digi 54xx Family","label":"digi 54xx family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 21.8.24.139","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 21.8.24.139","eol":null,"hubHref":"/vendor/digi_international/digi_54xx_family"},{"vendor":"digi international","product":"digi 63xx family","name":"Digi 63xx Family","label":"digi 63xx family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 22.5.50.66","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 22.5.50.66","eol":null,"hubHref":"/vendor/digi_international/digi_63xx_family"},{"vendor":"digi international","product":"digi ix14","name":"Digi IX14","label":"digi ix14","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 22.5.50.62","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 22.5.50.62","eol":null,"hubHref":"/vendor/digi_international/digi_ix14"},{"vendor":"digi international","product":"digi lr54 family","name":"Digi LR54 Family","label":"digi lr54 family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 23.12.1.56","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 23.12.1.56","eol":null,"hubHref":"/vendor/digi_international/digi_lr54_family"},{"vendor":"digi international","product":"ex family","name":"EX Family","label":"ex family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/ex_family"},{"vendor":"digi international","product":"ix family","name":"IX Family","label":"ix family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/ix_family"},{"vendor":"digi international","product":"tx family","name":"TX Family","label":"tx family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/tx_family"},{"vendor":"digi international","product":"xbee hive border router for wi-sun","name":"XBee Hive Border Router for Wi-SUN","label":"xbee hive border router for wi-sun","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/xbee_hive_border_router_for_wi-sun"},{"vendor":"digi international","product":"xbee hive gateway","name":"XBee Hive Gateway","label":"xbee hive gateway","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 21.8.24.139, ≤ 26.7.90.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 21.8.24.139, ≤ 26.7.90.14","eol":null,"hubHref":"/vendor/digi_international/xbee_hive_gateway"}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.digi.com/resources/security","label":"www.digi.com/resources/security","hostname":"www.digi.com","tags":["Mitigation","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-02T20:33:56.823Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-03T15:52:55.213Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:06:38.764Z","stale":false,"partial":false}}