OS Command Injection in Digi Accelerated Linux (DAL OS)
Summary
| CVE | CVE-2026-75937 |
|---|---|
| State | PUBLISHED |
| Assigner | Digi |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-02 21:16:56 UTC |
| Updated | 2026-10-03 16:16:38 UTC |
| Description | A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device. |
Risk And Classification
Primary CVSS: v4.0 9.4 CRITICAL from e8a6bb0b-e373-42b1-a5de-93e314325576
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-78 | CWE-78 CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | e8a6bb0b-e373-42b1-a5de-93e314325576 | Secondary | 9.4 | CRITICAL | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/C... |
| 4.0 | CNA | CVSS | 9.4 | CRITICAL | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
CVSS v4.0 Breakdown
Attack Vector
AdjacentAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
HighSub Integrity
HighSub Availability
HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Digi International | IX Family | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | EX Family | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | TX Family | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | Connect IT Family | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | AnywhereUSB Plus Family | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | Connect EZ Family | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | XBee Hive Gateway | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | XBee Hive Border Router For Wi-SUN | affected 21.8.24.139 26.7.90.14 custom | Not specified |
| CNA | Digi International | Digi 54xx Family | affected 21.8.24.139 custom | Not specified |
| CNA | Digi International | Digi 63xx Family | affected 21.8.24.139 22.5.50.66 custom | Not specified |
| CNA | Digi International | Digi IX14 | affected 21.8.24.139 22.5.50.62 custom | Not specified |
| CNA | Digi International | Digi LR54 Family | affected 21.8.24.139 23.12.1.56 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.digi.com/resources/security | e8a6bb0b-e373-42b1-a5de-93e314325576 | www.digi.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: 美团众包骑手:键盘手欧多克 (en)
There are currently no legacy QID mappings associated with this CVE.