High severity · published Dec 10, 2021
CVE-2021-37189
An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Transport Wr11 Firmware · Digi
before 6.0.0.0 · source: NVD
TW
Transport Wr11 XT Firmware · Digi
before 6.0.0.0 · source: NVD
TW
Transport Wr21 Firmware · Digi
before 6.0.0.0 · source: NVD
TW
Transport Wr31 Firmware · Digi
before 6.0.0.0 · source: NVD
TW
Transport Wr41 Firmware · Digi
before 6.0.0.0 · source: NVD
TW
Transport Wr44 Firmware · Digi
before 6.0.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-37189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-37189
Third Party Advisory
https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
Vendor Advisory
https://www.digi.com/search/results?q=transport
More from Transport Wr11 Firmware
9.8
CVE-2021-35978
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR
8.8
CVE-2021-37188
An issue was discovered on Digi TransPort devices through 2021-07-21
6.5
CVE-2021-37187
An issue was discovered on Digi TransPort devices through 2021-07-21