CVE-2022-26952

Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
VendorProductVersion
digipassport_firmware
𝑥
≤ 1.5.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md
https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/
https://hub.digi.com/support/products/infrastructure-management/digi-passport/
https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md
https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/
https://hub.digi.com/support/products/infrastructure-management/digi-passport/