CVE-2021-35978 Command injection in n/a
Attackers can execute arbitrary commands with super privileges on Digi TransPort routers via the ZING protocol, enabling full device compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-35978?
CVE-2021-35978 is a critical command injection vulnerability in n/a, published on 10 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.
Weakness: CWE-77
Which versions are affected by CVE-2021-35978?
It affects 9 products.
Products include Digi Transport Dr64 Firmware, Digi Transport Sr44 Firmware, Digi Transport Vc74 Firmware, Digi Transport Wr11 Firmware, Digi Transport Wr11 Xt Firmware, Digi Transport Wr21 Firmware and 3 more.
How do I fix CVE-2021-35978?
No fix has been published for CVE-2021-35978 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-35978 being exploited?
There is no known exploitation of CVE-2021-35978 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-62p6-2538-mvjg.