Critical severity · published Oct 2, 2026
CVE-2026-75937
OS Command Injection in Digi Accelerated Linux (DAL OS)
9.4
CVSS
0.5%
EPSS
No
On KEV
Description
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
AnywhereUSB Plus Family · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor
CE
Connect EZ Family · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor
CI
Connect IT Family · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor
D5
Digi 54xx Family · Digi International
through 21.8.24.139 · source: vendor
D6
Digi 63xx Family · Digi International
21.8.24.139 through 22.5.50.66 · source: vendor
DI
Digi IX14 · Digi International
21.8.24.139 through 22.5.50.62 · source: vendor
DL
Digi LR54 Family · Digi International
21.8.24.139 through 23.12.1.56 · source: vendor
EF
EX Family · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor
IF
IX Family · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor
TF
TX Family · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor
XH
XBee Hive Border Router for Wi-SUN · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor
XH
XBee Hive Gateway · Digi International
21.8.24.139 through 26.7.90.14 · source: vendor