Digi International PortServer TS, Digi One SP IA

Digi International has issued a security advisory regarding critical vulnerabilities (CVE-2026-12948) in its PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA devices. These vulnerabilities allow an unauthenticated attacker to bypass authentication and gain access to restricted resources by injecting malicious scripts through a web management interface. Successful exploitation could lead to credential theft and system compromise. Digi International recommends upgrading to Digi Connect EZ or Digi Connect EZ TS as a long-term solution, or implementing compensating controls like disabling the web server and restricting access via firewall or VPN.