CVE-2024-50625

HIGH

Digi Connectport Lts Firmware < 1.4.12 - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities.

References (3)

Core 3

Scores

CVSS v3 8.0
EPSS 0.0025
EPSS Percentile 47.8%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
digi/connectport_lts_firmware < 1.4.12
Published Dec 09, 2024
Tracked Since Feb 18, 2026