CISA 2026-07-07

Digi International PortServer TS, Digi One SP IA

CVE-2026-12352

Machine-generated analysis · WAYSCloud LLM

The advisory states that affected Digi devices can allow unauthenticated access to restricted resources due to an authorization flaw.

Context

The affected products are Digi International's PortServer TS and Digi One SP IA serial-to-IP converters used for remote device connectivity. The advisory identifies an incorrect authorization vulnerability that could allow an unauthenticated actor to bypass authentication and access restricted resources. It also notes a cross-site scripting vulnerability in the same product line. The vendor recommends disabling the web server or enabling HTTPS, with a long-term migration to newer models.

Operator considerations

Check: Determine if PortServer TS or Digi One SP IA devices are in use with firmware prior to 2025.
Patch: Upgrade to Digi Connect EZ or Digi Connect EZ TS if possible; otherwise enable HTTPS or disable the web server.
Isolate: Restrict access to affected devices using firewalls or VPNs if mitigation is not immediately feasible.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and gain access to restricted resources, obtain credentials, and inject malicious scripts.

The following versions of Digi International PortServer TS, Digi One SP IA are affected:

PortServer TS

Digi One SP

Digi One SP IA

Digi One IA

Vendor

Equipment

Digi International

Digi International PortServer TS, Digi One SP IA

Incorrect Authorization, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Critical Infrastructure Sectors: Critical Manufacturing, Communications, Information Technology, Transportation Systems

Countries/Areas Deployed: Worldwide

Company Headquarters Location: United States

The vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.

Digi International PortSe...

Read the full advisory on CISA →