CVE-2021-35977 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 76%

Affected Products (NVD)

Vendor	Product	Version
digi	realport	𝑥 ≤ 1.9-40
digi	realport	𝑥 ≤ 4.8.488.0
digi	connectport_ts_8\/16_firmware	*
digi	connectport_lts_8\/16\/32_firmware	*
digi	passport_integrated_console_server_firmware	*
digi	cm_firmware	*
digi	portserver_ts_firmware	*
digi	portserver_ts_mei_firmware	*
digi	portserver_ts_mei_hardened_firmware	*
digi	portserver_ts_m_mei_firmware	*
digi	6350-sr_firmware	*
digi	portserver_ts_p_mei_firmware	*
digi	transport_wr11_xt_firmware	*
digi	one_iap_family_firmware	*
digi	one_ia_firmware	*
digi	wr31_firmware	*
digi	wr44_r_firmware	*
digi	connect_es_firmware	*
digi	wr21_firmware	*

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt