CVE-2026-12948
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability was found in the web management interface of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA devices. A remote, authenticated administrator can inject malicious script into system configuration fields, which then executes in the browser of any user viewing the affected pages.
Risk Assessment
The risk includes session hijacking, account takeover, or unauthorized actions in the victim's browser context, potentially compromising the confidentiality and integrity of data managed by the device.
Recommendation
Immediately update the firmware of affected Digi devices to the latest version that patches this vulnerability. Until then, restrict management interface access to trusted administrators only.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).