CVE-2023-4299
Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication
CVE-2023-4299 is a critical vulnerability (CVSS 9.0) in Digi Realport, published August 31, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. No source names a fixed version.
- Severity
- 9.0 CriticalCVSS 3.1, CVE List
- Exploit chance
- 0.68%EPSS, 52nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- digi realport
- digi cm firmware
- digi connect es firmware
- digi connect sp firmware
- digi connectport lts 8\/16\/32 firmware
- digi connectport ts 8\/16 firmware
- digi one ia firmware
- digi one iap firmware
- digi one sp firmware
- digi one sp ia firmware
- digi passport firmware
- digi portserver ts firmware
Show 30 moreShow less
- digi portserver ts m mei firmware
- digi portserver ts mei firmware
- digi portserver ts mei hardened firmware
- digi portserver ts p mei firmware
- digi transport wr11 xt firmware
- digi wr21 firmware
- digi wr31 firmware
- digi wr44 r firmware
- digi international realport
- digi international 6350-sr
- digi international cm console server
- digi international connect es
- digi international connect sp
- digi international connectcore 8x products
- digi international connectport lts 8/16/32
- digi international connectport ts 8/16
- digi international one ia
- digi international one iap family
- digi international one sp ia
- digi international passport console server
- digi international portserver ts
- digi international portserver ts m mei
- digi international portserver ts mei
- digi international portserver ts mei hardened
- digi international portserver ts p mei
- digi international wr11 xt
- digi international wr21
- digi international wr31
- digi international wr44 r
- digi international digi one sp
What each source reports
CVE List Score used
Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
- Record
CVE-2023-4299- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-836
- Updated
- 2026-11-02
EUVDEUVD-2023-54170
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
- Record
EUVD-2023-54170- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6mw3-9jr4-xc73
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass...
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
- Record
GHSA-6mw3-9jr4-xc73- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-836
- Updated
- 2026-11-02
NVD
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
- Record
CVE-2023-4299- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-836
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.