Attack Chain

1. Initial Access via Web Interface: An unauthenticated attacker targets the web management interface of a vulnerable Digi International PortServer TS, Digi One SP, Digi One SP IA, or Digi One IA device.
2. Authentication Bypass (CVE-2026-12352): The attacker exploits the incorrect authorization vulnerability (CVE-2026-12352) to bypass the device's authentication mechanisms.
3. Access Restricted Resources: Upon successful bypass, the attacker gains unauthorized access to restricted administrative resources and potentially sensitive configuration or operational data on the device.
4. Credential Acquisition: Through access to restricted resources (or other means), the attacker obtains valid administrative credentials for the device.
5. Malicious Script Injection (CVE-2026-12948): As an authenticated administrator, the attacker injects malicious scripts (e.g., JavaScript) into system configuration fields through the web management interface, leveraging the stored XSS vulnerability (CVE-2026-12948).
6. Client-Side Script Execution: A legitimate user, such as an IT or OT operator, views the affected administrative web pages, causing the injected malicious script to execute within their browser session.
7. Browser Session Compromise: The executed script allows the attacker to steal the legitimate user's session cookies, impersonate the user, or potentially redirect them to malicious sites for further credential phishing.
8. Further Device Control or Data Exfiltration: Leveraging the compromised session or stolen credentials, the attacker could perform unauthorized configuration changes, exfiltrate sensitive device data, or maintain persistence within the OT network segment.

Impact

Successful exploitation of these vulnerabilities could lead to significant operational disruptions and security breaches within critical infrastructure sectors globally. An unauthenticated bypass (CVE-2026-12352) grants attackers access to restricted device resources, allowing for potential manipulation or theft of sensitive operational technology data and administrative credentials. The stored cross-site scripting (CVE-2026-12948) further enables attackers to compromise legitimate user browser sessions, potentially leading to additional credential theft or unauthorized actions in the browser context. Affected devices are deployed worldwide across Critical Manufacturing, Communications, Information Technology, and Transportation Systems. Digi International will not provide firmware fixes for CVE-2026-12948 for products nearing end-of-life, increasing long-term risk for organizations unable to upgrade.

Recommendation

• Upgrade affected Digi International devices to Digi Connect EZ or Digi Connect EZ TS as a long-term solution recommended by the vendor for CVE-2026-12352 and CVE-2026-12948.
• For Digi PortServer TS, enable HTTPS on the web server to mitigate exploitation of CVE-2026-12352 and CVE-2026-12948.
• For Digi One SP / Digi One SP IA / Digi One IA, disable the web server when not actively used for configuration to mitigate CVE-2026-12352 and CVE-2026-12948.
• Restrict access to the web management interface of affected devices via a firewall or VPN as a compensating control for CVE-2026-12352 and CVE-2026-12948.
• Safeguard administrator credentials, as exploitation of CVE-2026-12948 requires authenticated administrator access for script injection.
• Deploy affected devices on trusted network segments, ensuring they are not exposed to untrusted or public networks, as a general recommended practice for all vulnerabilities discussed.