title: Digi PortServer TS 16 Improper Authentication
description: Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
problem types: CWE-287 Improper Authentication
affected:
{
product: PortServer TS 16
vendor: Digi International
versions:
lessThanOrEqual: 82000684, status: affected, version: Firmware, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
version: 3.1
]
solutions: The PortServer TS 16 product was discontinued in 2016. Per Digi’s security support, the device software and hardware support of 5 years has passed. Digi recommends upgrading to a new supported product. If this is not possible, extended support may be available by contacting Digi directly.