PT-2024-34368 · Digi · Digi Connectport Lts

Published 2024-12-09 · Updated 2025-06-27 · CVE-2024-50628

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Digi ConnectPort LTS versions prior to 1.4.12

Description: An issue was discovered in the web services of Digi ConnectPort LTS, allowing an attacker on the local area network to achieve unauthorized manipulation of resources. This may lead to remote code execution when combined with other issues.

Recommendations: For Digi ConnectPort LTS versions prior to 1.4.12, update to version 1.4.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the web services to minimize the risk of exploitation.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-50628

Affected Products

Digi Connectport Lts

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-50628 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50628 · Vendor Advisory
• https://digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf · Vendor Advisory
• https://digi.com/resources/security · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1866369184562651294 · Twitter Post
• https://t.me/cvedetector/12456 · Telegram Post
• https://t.me/cvenotify/126910 · Telegram Post
• https://digi.com/resources/documentation/digidocs/pdfs/90001001.pdf · Note
• https://twitter.com/CVEnew/status/1866432981985816661 · Twitter Post