{"id":"CVE-2023-4299","aliases":["EUVD-2023-54170","GHSA-6mw3-9jr4-xc73"],"status":"published","title":"Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication","description":"Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0068,"percentile":0.52739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-836"],"published":"2023-08-31T20:45:43Z","modified":"2026-06-17T06:37:31Z","products":[{"vendor":"digi","product":"cm_firmware"},{"vendor":"digi","product":"connect_es_firmware"},{"vendor":"digi","product":"connect_sp_firmware"},{"vendor":"digi","product":"connectport_lts_8\\/16\\/32_firmware"},{"vendor":"digi","product":"connectport_ts_8\\/16_firmware"},{"vendor":"digi","product":"one_ia_firmware"},{"vendor":"digi","product":"one_iap_firmware"},{"vendor":"digi","product":"one_sp_firmware"},{"vendor":"digi","product":"one_sp_ia_firmware"},{"vendor":"digi","product":"passport_firmware"},{"vendor":"digi","product":"portserver_ts_firmware"},{"vendor":"digi","product":"portserver_ts_m_mei_firmware"},{"vendor":"digi","product":"portserver_ts_mei_firmware"},{"vendor":"digi","product":"portserver_ts_mei_hardened_firmware"},{"vendor":"digi","product":"portserver_ts_p_mei_firmware"},{"vendor":"digi","product":"realport"},{"vendor":"digi","product":"transport_wr11_xt_firmware"},{"vendor":"digi","product":"wr21_firmware"},{"vendor":"digi","product":"wr31_firmware"},{"vendor":"digi","product":"wr44_r_firmware"},{"vendor":"digi international","product":"digi 6350-sr"},{"vendor":"digi international","product":"digi cm console server"},{"vendor":"digi international","product":"digi connect es"},{"vendor":"digi international","product":"digi connect sp"},{"vendor":"digi international","product":"digi connectcore 8x products"},{"vendor":"digi international","product":"digi connectport lts 8/16/32"},{"vendor":"digi international","product":"digi connectport ts 8/16"},{"vendor":"digi international","product":"digi one ia"},{"vendor":"digi international","product":"digi one iap family"},{"vendor":"digi international","product":"digi one sp ia"},{"vendor":"digi international","product":"digi passport console server"},{"vendor":"digi international","product":"digi portserver ts"},{"vendor":"digi international","product":"digi portserver ts m mei"},{"vendor":"digi international","product":"digi portserver ts mei"},{"vendor":"digi international","product":"digi portserver ts mei hardened"},{"vendor":"digi international","product":"digi portserver ts p mei"},{"vendor":"digi international","product":"digi realport"},{"vendor":"digi international","product":"digi wr11 xt"},{"vendor":"digi international","product":"digi wr21"},{"vendor":"digi international","product":"digi wr31"},{"vendor":"digi international","product":"digi wr44 r"},{"vendor":"digi international","product":"​digi one sp"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04","tags":["x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4299"},{"url":"https://github.com/advisories/GHSA-6mw3-9jr4-xc73"}],"sources":{"cve":[{"id":"CVE-2023-4299","title":"Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication","description":"\nDigi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.\n\n","status":"published","published":"2023-08-31T20:45:43.866Z","modified":"2025-01-16T21:30:37.81Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-836"],"updated_at":"2026-11-02T14:35:30.116696Z"}],"euvd":[{"id":"EUVD-2023-54170","description":"\nDigi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.\n\n","status":"published","published":"2023-08-31T20:45:43Z","modified":"2025-01-16T21:30:37Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:17.573711Z"}],"ghsa":[{"id":"GHSA-6mw3-9jr4-xc73","title":"\nDigi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass...","description":"\nDigi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.\n\n","status":"published","published":"2023-08-31T21:32:41Z","modified":"2024-04-04T07:20:59Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-836"],"updated_at":"2026-11-02T14:56:50.398159Z"}],"nvd":[{"id":"CVE-2023-4299","description":"\nDigi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.\n\n","status":"published","published":"2023-08-31T21:15:09.183Z","modified":"2026-06-17T06:37:31.58Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-836"],"updated_at":"2026-11-02T14:08:27.181588Z"}]}}