Critical severity · published Dec 10, 2021
CVE-2021-35978
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR
9.8
CVSS
3.7%
EPSS
No
On KEV
Description
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TD
Transport Dr64 Firmware · Digi
through 5.2.4.9 · source: NVD
TS
Transport Sr44 Firmware · Digi
All versions, or not specified · source: NVD
TV
Transport Vc74 Firmware · Digi
through 5.2.4.9 · source: NVD
TW
Transport Wr11 Firmware · Digi
through 8.2.1.3 · source: NVD
TW
Transport Wr11 XT Firmware · Digi
through 8.2.1.3 · source: NVD
TW
Transport Wr21 Firmware · Digi
through 8.2.1.3 · source: NVD
TW
Transport Wr31 Firmware · Digi
through 8.2.1.3 · source: NVD
TW
Transport Wr41 Firmware · Digi
5.0.0.0 through 5.2.4.6; 6.0.0.0 through 6.1.3.5; 8.0.0.0 through 8.3.1.2 · source: NVD
TW
Transport Wr44 Firmware · Digi
through 8.3.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35978
Vendor Advisory
https://digi.com
Third Party Advisory
https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
More from Transport Dr64 Firmware
8.8
CVE-2021-37188
An issue was discovered on Digi TransPort devices through 2021-07-21
6.5
CVE-2021-37187
An issue was discovered on Digi TransPort devices through 2021-07-21