CVE-2021-38412
published 2021-09-17CVE-2021-38412: Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.26%
66.0th percentile
Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| digi | portserver_ts_16_firmware | — | — |
| digi | portserver_ts_16_firmware | — | — |
| digi_international | portserver_ts_16 | Firmware – 82000684 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated POST requests to web resources on Digi PortServer TS 16 HTTP/HTTPS servers (ports 80/443); legitimate management should require authentication tokens — alert on POST requests lacking auth headers/tokens to this device's web interface. ↗
- →Monitor for unexpected SNMP service enablement or SNMP community string changes on Digi PortServer TS 16 devices, which may indicate post-exploitation activity following unauthenticated POST abuse. ↗
- →Flag Digi PortServer TS 16 devices running firmware versions 82000684 or 82000685 as vulnerable; inventory and prioritize these for network isolation. ↗
- →Successful exploitation grants command execution and CLI access; monitor for unexpected command-line activity or configuration changes originating from the device's management interface. ↗
- ·No known public exploits specifically target this vulnerability at time of advisory publication, reducing (but not eliminating) immediate exploitation risk. ↗
- ·The vulnerability is exploitable from adjacent network (AV:A per CVSS vector), not directly from the internet, so network segmentation is a highly effective control. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Digi PortServer TS 16
cisa_ics·2021-09-14·CVSS 9.6
[CRITICAL] Digi PortServer TS 16
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Digi PortServer TS 16
Last RevisedSeptember 14, 2021
Alert CodeICSA-21-257-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.6
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Digi International, Inc.
- Equipment: PortServer TS 16
- Vulnerability: Improper Authentication
## 2. RISK EVALUATION
Successful exploitation of this vulnerability allows write access, which grants control of settings, command execution, and access to the command line interface.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following firmware versions of Digi PortServer TS 16 are affe
GHSA
GHSA-5h3v-8m6q-48c4: Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authe
ghsa_unreviewed·2022-05-24
CVE-2021-38412 [CRITICAL] CWE-287 GHSA-5h3v-8m6q-48c4: Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authe
Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-09-17
Published