PT-2021-21345 · Digi · Digi Realport

Published 2021-10-08 · Updated 2023-09-25 · CVE-2021-36767

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Digi RealPort versions 4.8.488.0 through 4.10.490

Description The authentication mechanism in Digi RealPort relies on a challenge-response system that provides access to the server password, rendering the protection ineffective. An attacker can send an unauthenticated request to the server, which will respond with a weakly-hashed version of the server's access password. This hash can then be cracked offline, allowing the attacker to successfully log in to the server.

Recommendations For versions 4.8.488.0 through 4.10.490, consider disabling the challenge-response authentication mechanism until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2021-36767

Affected Products

Digi Realport

References · 4

• https://osv.dev/vulnerability/CVE-2021-36767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36767 · Security Note
• https://t.me/cibsecurity/30248 · Telegram Post
• https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt · Note