A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Digi International IX Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International EX Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International TX Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International Connect IT Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International AnywhereUSB Plus Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International Connect EZ Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International XBee Hive Gateway unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International XBee Hive Border Router for Wi-SUN unaffected
Version Status Constraints
21.8.24.139 affected ≤ 26.7.90.14
Digi International Digi 54xx Family unaffected
Version Status Constraints
0 affected ≤ 21.8.24.139
Digi International Digi 63xx Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 22.5.50.66
Digi International Digi IX14 unaffected
Version Status Constraints
21.8.24.139 affected ≤ 22.5.50.62
Digi International Digi LR54 Family unaffected
Version Status Constraints
21.8.24.139 affected ≤ 23.12.1.56

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.digi.com/resources/security cve-icon cve-icon
History

Fri, 02 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Title OS Command Injection in Digi Accelerated Linux (DAL OS)
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Digi

Published:

Updated: 2026-10-02T20:33:56.823Z

Reserved: 2026-08-18T15:53:39.284Z

Link: CVE-2026-75937

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-02T21:16:56.337

Modified: 2026-10-02T21:16:56.337

Link: CVE-2026-75937

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T21:30:18Z

Weaknesses