{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the string is concatenated to the HTML body."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-06T00:43:31", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://hub.digi.com/support/products/infrastructure-management/digi-passport/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md"}, {"tags": ["x_refsource_MISC"], "url": "https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2022-26953", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the string is concatenated to the HTML body."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://hub.digi.com/support/products/infrastructure-management/digi-passport/", "refsource": "MISC", "url": "https://hub.digi.com/support/products/infrastructure-management/digi-passport/"}, {"name": "https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md", "refsource": "MISC", "url": "https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md"}, {"name": "https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/", "refsource": "MISC", "url": "https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:18:38.396Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hub.digi.com/support/products/infrastructure-management/digi-passport/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-26953", "datePublished": "2022-04-06T00:43:31", "dateReserved": "2022-03-12T00:00:00", "dateUpdated": "2024-08-03T05:18:38.396Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:digi:passport_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDB03DD8-8A21-4E82-91F3-800F69CF69CF", "versionEndIncluding": "1.5.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:digi:passport:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6129E3F-BB64-47B1-8041-F955CAD1A139", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the string is concatenated to the HTML body."}, {"lang": "es", "value": "El firmware Digi Passport versiones hasta 1.5.1,1 est\u00e1 afectado por un desbordamiento de b\u00fafer. Un atacante puede suministrar una cadena en el par\u00e1metro de p\u00e1gina para el endpoint reboot.asp, permitiendo forzar un desbordamiento cuando la cadena es concatenada con el cuerpo HTML"}], "id": "CVE-2022-26953", "lastModified": "2024-11-21T06:54:52.003", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-04-06T01:15:07.143", "references": [{"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md"}, {"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/"}, {"source": "[email protected]", "tags": ["Product", "Vendor Advisory"], "url": "https://hub.digi.com/support/products/infrastructure-management/digi-passport/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Vendor Advisory"], "url": "https://hub.digi.com/support/products/infrastructure-management/digi-passport/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}

{}