CVE-2022-26952

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.mdExploit, Third Party Advisory
https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/Release Notes, Vendor Advisory
https://hub.digi.com/support/products/infrastructure-management/digi-passport/Patch, Product, Vendor Advisory
https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2022-26952%20%26%20CVE-2022-26953/readme.mdExploit, Third Party Advisory
https://hub.digi.com/dp/path=/support/asset/digi-passport-1.5.2-firmware-release-notes/Release Notes, Vendor Advisory
https://hub.digi.com/support/products/infrastructure-management/digi-passport/Patch, Product, Vendor Advisory

Timeline

Published: Apr 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-269537.5Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.as CVE-2022-269546.1Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting CVE-2022-269599.8There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The CVE-2022-26966.5The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX a CVE-2022-269609.1connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, CVE-2022-269615.4Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMS CVE-2022-269625.4Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announce CVE-2022-269647.5Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-f CVE-2022-269657.2In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.CVE-2022-269665.5An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from h CVE-2022-269677.8GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.CVE-2022-269699.8In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.