Home

Description

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).

PUBLISHED Reserved 2026-06-22 | Published 2026-07-07 | Updated 2026-07-13 | Assigner Digi




MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Product status

Default status
unaffected

82000747_V1 (custom)
affected

Default status
unaffected

82000774_Z (custom)
affected

Default status
unaffected

82000774_Z (custom)
affected

Default status
unaffected

82000774_Z (custom)
affected

References

www.digi.com/resources/security

cve.org (CVE-2026-12948)

nvd.nist.gov (CVE-2026-12948)

Download JSON