# Digi PortServer Authentication Bypass and Web XSS Expose Critical Manufacturing Infrastructure Worldwide


## The Threat


Digi International has disclosed critical vulnerabilities in its widely deployed PortServer TS and Digi One device series that could allow attackers to bypass authentication entirely and inject malicious code into administrative consoles. The flaws affect network access servers used extensively in manufacturing facilities, telecommunications hubs, and transportation systems across dozens of countries.


The authentication bypass (CVE-2026-12352) is particularly severe because it requires no credentials and no user interaction—an attacker on the network can directly access restricted configuration resources. This is compounded by a stored cross-site scripting vulnerability (CVE-2026-12948) that allows authenticated administrators to inject JavaScript that executes in the browsers of other users viewing the management interface, potentially harvesting credentials or lateral movement vectors.


Together, these vulnerabilities create a two-stage attack pattern: gain unauthorized access through the authentication bypass, then escalate by injecting malicious scripts to compromise administrative sessions. In operational technology (OT) environments where these devices control physical systems, the implications extend beyond data theft to potential disruption of critical infrastructure.


## Severity and Impact


| Metric | CVE-2026-12352 | CVE-2026-12948 |

|--------|---|---|

| CVE ID | CVE-2026-12352 | CVE-2026-12948 |

| Product | Digi PortServer TS, Digi One SP/SP IA/IA | Digi PortServer TS, Digi One SP/SP IA/IA |

| Vulnerability Type | Incorrect Authorization (CWE-863) | Stored Cross-Site Scripting (CWE-79) |

| CVSS v3.1 Score | 5.9 (Medium) | Not explicitly stated |

| CVSS v4.0 Score | 8.2 (High) | Not explicitly stated |

| Vector String v3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | Network-based, authenticated |

| Vector String v4.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | Network-based, lower complexity |

| Attack Complexity | High | High |

| Authentication Required | None (CVE-2026-12352) | Yes (CVE-2026-12948) |

| User Interaction | None | None |


## Affected Products


Digi International's advisory identifies the following products running vulnerable firmware versions prior to Firmware_2025:


  • Digi PortServer TS — All affected versions
  • Digi One SP — All affected versions
  • Digi One SP IA — All affected versions
  • Digi One IA — All affected versions

    • All listed products are affected by both vulnerabilities when running firmware versions earlier than the 2025 release stream.


    ## Mitigations


    Immediate Actions (Before Firmware Update)


    For PortServer TS devices:

  • Enable HTTPS on the web management server to encrypt traffic and add a layer of protection
  • Alternatively, disable the web server entirely when not actively configuring the device
  • If HTTPS is not feasible, restrict access to the management interface via firewall rules or VPN—allowing only known administrative hosts

    • For Digi One SP / Digi One SP IA / Digi One IA devices:

  • Disable the web management server completely, using serial console for any necessary configuration
  • If the server must remain enabled, restrict network access via firewall or VPN policies
  • Ensure administrator credentials are not shared or stored insecurely, as authenticated exploitation of CVE-2026-12948 requires valid admin access

    • Long-Term Solution


    Digi International recommends upgrading to Digi Connect EZ or Digi Connect EZ TS as a permanent replacement, particularly for organizations unable to apply near-term security controls.


    Deployment Hardening


  • Isolate affected devices on trusted network segments, never directly exposing them to public internet or untrusted networks
  • Implement network segmentation using firewalls or VLANs to separate administrative access from production traffic
  • Restrict web management interface access to a whitelist of known administrative workstations
  • Monitor access logs for suspicious authentication attempts or unusual configuration changes

    • For ongoing support and detailed patching timelines, contact Digi International's support team at https://www.digi.com/support.


    ## References


  • Digi International Security Advisory: https://www.digi.com/support
  • CVE-2026-12352 Details: https://www.cve.org/CVERecord?id=CVE-2026-12352
  • CVE-2026-12948 Details: https://www.cve.org/CVERecord?id=CVE-2026-12948
  • CISA Vulnerability Guidance: Consult your regional CISA or cybersecurity authority for coordinated disclosure updates

    • ---


    ## HackWire Analysis


    These vulnerabilities expose a persistent blind spot in industrial infrastructure security: the assumption that network access servers living behind corporate firewalls need not be updated at the same cadence as internet-facing systems. The authentication bypass in CVE-2026-12352 demolishes that assumption—an attacker with basic network access (insider threat, compromised VPN, or lateral movement from another breached system) gains direct administrative control without ever needing a password.


    The pairing with stored XSS is particularly telling. It suggests that once an attacker has administrative footing, they can inject malicious scripts into the management console itself, turning the administrative interface into a credential harvester. In environments where dozens of engineers and vendors access these devices for configuration and troubleshooting, a single injected script could compromise the entire administrative community.


    What makes this noteworthy is the pattern it follows: Digi's recommendation to upgrade to newer product lines (Connect EZ) rather than promise aggressive patching of legacy devices. Organizations relying on PortServer TS and Digi One hardware in mission-critical OT environments—especially in manufacturing and power distribution—now face a binary choice: accept the risk, invest in network isolation that slows operations, or budget for hardware replacement. This mirrors the industry-wide reckoning with legacy industrial equipment that was never designed to be patched like consumer software.


    Defenders should prioritize these devices for network segmentation audits immediately. If these boxes are sitting on a flat OT network with easy lateral movement paths, the window for privileged-access exploitation narrows significantly. The authentication bypass lowers the attacker's cost; network isolation raises it back up.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)