CVE-2023-4299

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-836

Affected software

VendorProductVersions
Digi International Digi RealPort<= 4.8.488.0
Digi International Digi RealPort<= 1.9-40
Digi International Digi ConnectPort TS 8/16< 2.26.2.4
Digi International Digi Passport Console Serverall versions
Digi International Digi ConnectPort LTS 8/16/32< 1.4.9
Digi International Digi CM Console Serverall versions
Digi International Digi PortServer TSall versions
Digi International Digi PortServer TS MEIall versions
Digi International Digi PortServer TS MEI Hardenedall versions
Digi International Digi PortServer TS M MEIall versions
Digi International Digi PortServer TS P MEIall versions
Digi International Digi One IAP Familyall versions
Digi International Digi One IAall versions
Digi International Digi One SP IAall versions
Digi International ​Digi One SPall versions
Digi International Digi WR31all versions
Digi International Digi WR11 XTall versions
Digi International Digi WR44 Rall versions
Digi International Digi WR21all versions
Digi International Digi Connect ES< 2.26.2.4
Digi International Digi Connect SPall versions
Digi International Digi 6350-SR—
Digi International Digi ConnectCore 8X products—

References

Timeline

Published
Aug 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-43007.2The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to uploaCVE-2023-430008.8A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, SCVE-2023-43015.4A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-sCVE-2023-430108.8The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS CVE-2023-430139.8Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, aCVE-2023-430148.8Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'first_name' and 'last_name' parameters CVE-2023-430155.4IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2023-430167.3IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker CVE-2023-430177.2IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote aCVE-2023-430187.5IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required,CVE-2023-43024.3A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attaCVE-2023-430215.3IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message
CVE-2023-4299: High severity, CVSS 8.1 | Vulnix