CVE-2025-3659
Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
-
Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022
-
Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020
-
Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
-
Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022
-
Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020
-
Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
- Record
CVE-2025-3659- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2025-14274
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
-
Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022
-
Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020
-
Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
- Record
EUVD-2025-14274- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r6rh-c775-h225
Improper authentication handling was identified in a set of HTTP POST requests affecting the...
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
-
Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022
-
Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020
-
Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
- Record
GHSA-r6rh-c775-h225- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:
-
Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022
-
Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020
-
Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020
A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings.
- Record
CVE-2025-3659- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3659 is a critical vulnerability (CVSS 9.4) in Digi International One Iap, published May 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.
References
hub.digi.com/support/products/infrastructure-management/digi-portserver-ts
digi.com/getattachment/Resources/Security/Alerts/Improper-authentication-handling-for-Digi-PortServ/improper-authentication-handling.pdf
nvd.nist.gov/vuln/detail/CVE-2025-3659
github.com/advisories/GHSA-r6rh-c775-h225