DEV Community

facilishz
facilishz

Posted on

Mapping the CVE-2026-75937 version matrix across DAL OS

#security #vulnerability #cve202675937 #digi

Mapping the CVE-2026-75937 version matrix across DAL OS

Overview

CVE-2026-75937 is an unauthenticated operating system command injection in the web administration
service of Digi Accelerated Linux (DAL OS). It carries CWE-78 and a CVSS 4.0 score of 9.4.

Affected and fixed builds

DAL OS versions 21.8.24.139 through 26.7.90.14 are affected. The vendor shipped three separate fixed
builds rather than one, which is the detail that makes a version audit necessary:

  • 26.2.148.166 LTS and 26.7.90.15 for most IX, EX, TX and Connect IT models
  • 26.2.148.166 LTS for AnywhereUSB Plus and Connect EZ devices
  • 26.9.10.28 for the XBee Hive gateways and IX15

The 54xx, 63xx, IX14 and LR54 families are end of life and will stay unpatched.

Mechanism

The flaw is an operating system command injection, catalogued as CWE-78, in the web administration service of Digi Accelerated Linux, the firmware Digi ships as DAL OS. Digi's advisory states that a specifically crafted HTTP POST request to the web administration interface lets an unauthenticated attacker execute arbitrary operating system commands with root privileges. The report rates the issue 9.4 on CVSS 4.0.

Reachability and impact

By default only clients on the local LAN subnet reach the web interface. Digi warns that deployments which opened that interface to other subnets or to the WAN carry the higher, CVSS 10.0 risk profile. No public proof-of-concept and no confirmed in-the-wild exploitation had been reported when the advisory was published.

Exposure context

ZoomEye recorded 47,984 assets matching app="Digi" on 2026-10-03. Those are fingerprint matches
for the vendor's products, and the honest reading is that they bound the installed base, not the
count of exploitable devices.

Remediation

Update to the branch build that matches each model. Rotate the admin password afterwards. If a device
cannot be updated, disable the web administration service between configuration sessions and check
whether a Digi Remote Manager template would re-enable it.

References

Top comments (0)