VULNERABILITY INTELLIGENCE

CVE-2021-38412

CVSS score9.6 CRITICAL
EPSS probability1.34%
CISA KEVNot currently listed
Published2021-09-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Description

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.

Weakness classification

  • ics-cert@hq.dhs.gov: CWE-287
  • nvd@nist.gov: CWE-306

Primary references