Riskcovery

CVE-2026-75937

OS Command Injection in Digi Accelerated Linux (DAL OS)

State
Published
Severity
9.4 Critical
Published
Oct 2, 2026
Updated
Oct 3, 2026
Reserved
Aug 18, 2026

Read the record on cve.org

Description

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Scores

CVSSScoreVectorSource
4.09.4 CriticalCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HDigi

Weaknesses

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

ProductVersions
IX FamilyDigi International
  • 21.8.24.139 through 26.7.90.14Affected
EX FamilyDigi International
  • 21.8.24.139 through 26.7.90.14Affected
TX FamilyDigi International
  • 21.8.24.139 through 26.7.90.14Affected
Connect IT FamilyDigi International
  • 21.8.24.139 through 26.7.90.14Affected
AnywhereUSB Plus FamilyDigi International
  • 21.8.24.139 through 26.7.90.14Affected
Connect EZ FamilyDigi International
  • 21.8.24.139 through 26.7.90.14Affected
XBee Hive GatewayDigi International
  • 21.8.24.139 through 26.7.90.14Affected
XBee Hive Border Router for Wi-SUNDigi International
  • 21.8.24.139 through 26.7.90.14Affected
Digi 54xx FamilyDigi International
  • 21.8.24.139 and earlierAffected
Digi 63xx FamilyDigi International
  • 21.8.24.139 through 22.5.50.66Affected
Digi IX14Digi International
  • 21.8.24.139 through 22.5.50.62Affected
Digi LR54 FamilyDigi International
  • 21.8.24.139 through 23.12.1.56Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.