CVE-2026-75937

published 2026-10-02

CVE-2026-75937: A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands…

Priority P2 66 critical 9.4 CVSS 4.0

AV A AC L AT N PR N UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
digi_international	anywhereusb_plus_family	21.8.24.139 – 26.7.90.14	—
digi_international	connect_ez_family	21.8.24.139 – 26.7.90.14	—
digi_international	connect_it_family	21.8.24.139 – 26.7.90.14	—
digi_international	digi_54xx_family	<= 21.8.24.139	—
digi_international	digi_63xx_family	21.8.24.139 – 22.5.50.66	—
digi_international	digi_ix14	21.8.24.139 – 22.5.50.62	—
digi_international	digi_lr54_family	21.8.24.139 – 23.12.1.56	—
digi_international	ex_family	21.8.24.139 – 26.7.90.14	—
digi_international	ix_family	21.8.24.139 – 26.7.90.14	—
digi_international	tx_family	21.8.24.139 – 26.7.90.14	—
digi_international	xbee_hive_border_router_for_wi-sun	21.8.24.139 – 26.7.90.14	—
digi_international	xbee_hive_gateway	21.8.24.139 – 26.7.90.14	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78