CVE-2023-4299: Digi RealPort Protocol Use of Password Hash…

Record summary

CVE-2023-4299 has a selected CVSS score of 9.0 (critical).

Description

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 16, 2025 · Source: CVE List

Affected products and versions

Showing 12 of 22

Product	Source	Version range	Status
Digi 6350-SR Browse Digi International / Digi 6350-SR Default status: unaffected	CVE List	all versions	unaffected
Digi CM Console Server Browse Digi International / Digi CM Console Server Default status: unaffected	CVE List	all versions	affected
Digi Connect ES Browse Digi International / Digi Connect ES Default status: unaffected	CVE List	Before 2.26.2.4	affected
Digi Connect SP Browse Digi International / Digi Connect SP Default status: unaffected	CVE List	all versions	affected
Digi ConnectCore 8X products Browse Digi International / Digi ConnectCore 8X products Default status: unaffected	CVE List	all versions	unaffected
Digi ConnectPort LTS 8/16/32 Browse Digi International / Digi ConnectPort LTS 8/16/32 Default status: unaffected	CVE List	Before 1.4.9	affected
Digi ConnectPort TS 8/16 Browse Digi International / Digi ConnectPort TS 8/16 Default status: unaffected	CVE List	Before 2.26.2.4	affected
Digi One IA Browse Digi International / Digi One IA Default status: unaffected	CVE List	all versions	affected
Digi One IAP Family Browse Digi International / Digi One IAP Family Default status: unaffected	CVE List	all versions	affected
Digi One SP IA Browse Digi International / Digi One SP IA Default status: unaffected	CVE List	all versions	affected
Digi Passport Console Server Browse Digi International / Digi Passport Console Server Default status: unaffected	CVE List	all versions	affected
Digi PortServer TS Browse Digi International / Digi PortServer TS Default status: unaffected	CVE List	all versions	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2023-4299

cisa.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04

digi.com

https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf

CVE-2023-4299

Record summary

Description

Exploitation context

CISA SSVC decision

Affected products and versions

Digi 6350-SR

Digi CM Console Server

Digi Connect ES

Digi Connect SP

Digi ConnectCore 8X products

Digi ConnectPort LTS 8/16/32

Digi ConnectPort TS 8/16

Digi One IA

Digi One IAP Family

Digi One SP IA

Digi Passport Console Server

Digi PortServer TS

References