CVE-2021-35979

An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:digi:realport:*:*:*:*:*:linux:*:*
cpe:2.3:a:digi:realport:*:*:*:*:*:windows:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:digi:connectport_ts_8\/16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_ts_8\/16:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:digi:connectport_lts_8\/16\/32_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_8\/16\/32:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:digi:passport_integrated_console_server_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:passport_integrated_console_server:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:digi:cm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:cm:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:digi:portserver_ts_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:digi:portserver_ts_mei_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_mei:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:digi:portserver_ts_mei_hardened_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_mei_hardened:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:digi:portserver_ts_m_mei_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_m_mei:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:digi:6350-sr_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:6350-sr:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:digi:portserver_ts_p_mei_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_p_mei:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:digi:transport_wr11_xt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:transport_wr11_xt:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:digi:one_iap_family_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:one_iap_family:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:digi:one_ia_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:one_ia:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:digi:wr31_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:wr31:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:digi:wr44_r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:wr44_r:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:digi:connect_es_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:connect_es:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:digi:wr21_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:wr21:-:*:*:*:*:*:*:*

History

26 May 2023, 18:18

Type Values Removed Values Added
CPE cpe:2.3:h:digi:connectcore_8x:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:connectcore_8x_firmware:*:*:*:*:*:*:*:*

12 Jul 2022, 17:42

Type Values Removed Values Added
CWE CWE-287 CWE-306

15 Oct 2021, 19:24

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : 6.8
v3 : 8.1
CWE CWE-287
CPE cpe:2.3:o:digi:cm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:wr44_r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:wr31_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:portserver_ts_p_mei_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:6350-sr_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:connectport_ts_8\/16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:wr21_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:wr31:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_mei_hardened:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:portserver_ts_mei_hardened_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:portserver_ts_mei_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_mei:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:portserver_ts_m_mei_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:transport_wr11_xt:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:passport_integrated_console_server_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectcore_8x:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:one_iap_family_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:connectport_lts_8\/16\/32_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_8\/16\/32:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_p_mei:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connect_es:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:wr21:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:connectcore_8x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:passport_integrated_console_server:-:*:*:*:*:*:*:*
cpe:2.3:a:digi:realport:*:*:*:*:*:windows:*:*
cpe:2.3:o:digi:portserver_ts_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:wr44_r:-:*:*:*:*:*:*:*
cpe:2.3:a:digi:realport:*:*:*:*:*:linux:*:*
cpe:2.3:h:digi:6350-sr:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:connect_es_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:portserver_ts_m_mei:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_ts_8\/16:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:one_ia_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:digi:transport_wr11_xt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:one_ia:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:one_iap_family:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:cm:-:*:*:*:*:*:*:*
References (MISC) https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt - (MISC) https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt - Third Party Advisory

08 Oct 2021, 15:22

Type Values Removed Values Added
New CVE

Information

Published : 2021-10-08 15:15

Updated : 2023-12-10 14:09


NVD link : CVE-2021-35979

Mitre link : CVE-2021-35979

CVE.ORG link : CVE-2021-35979


JSON object : View

Products Affected

digi

  • 6350-sr
  • wr21
  • portserver_ts_mei_firmware
  • connectport_ts_8\/16
  • one_iap_family
  • wr31
  • portserver_ts_p_mei
  • connect_es
  • wr44_r
  • wr21_firmware
  • transport_wr11_xt_firmware
  • connectport_lts_8\/16\/32_firmware
  • one_iap_family_firmware
  • 6350-sr_firmware
  • portserver_ts_mei_hardened
  • portserver_ts_firmware
  • passport_integrated_console_server
  • cm
  • connectport_lts_8\/16\/32
  • portserver_ts
  • one_ia
  • portserver_ts_mei
  • one_ia_firmware
  • connectport_ts_8\/16_firmware
  • passport_integrated_console_server_firmware
  • wr44_r_firmware
  • transport_wr11_xt
  • portserver_ts_m_mei_firmware
  • portserver_ts_p_mei_firmware
  • portserver_ts_m_mei
  • cm_firmware
  • connect_es_firmware
  • realport
  • wr31_firmware
  • portserver_ts_mei_hardened_firmware
CWE
CWE-306

Missing Authentication for Critical Function