CVE-2022-26952

EUVD-2022-31496
Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Affected Products (NVD)
VendorProductVersion
digipassport_firmware
𝑥
≤ 1.5.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md
https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/
https://hub.digi.com/support/products/infrastructure-management/digi-passport/
https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md
https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/
https://hub.digi.com/support/products/infrastructure-management/digi-passport/