CVE-2026-75937OS Command Injection in Digi Accelerated Linux (DAL OS)
Updated under an hour ago ()
Does this affect you?
It affects Digi International IX Family and 11 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.53%, higher than 43% of scored CVEs.
Do this next
Free account, 1 product
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
- CVSS
- 9.4 CRITICAL (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.53% (percentile 43)
- Assigned by
- Digi
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Digi International IX Family digi_international:ix_family (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International EX Family digi_international:ex_family (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International TX Family digi_international:tx_family (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International Connect IT Family digi_international:connect_it_family (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International AnywhereUSB Plus Family digi_international:anywhereusb_plus_family (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International Connect EZ Family digi_international:connect_ez_family (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International XBee Hive Gateway digi_international:xbee_hive_gateway (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International XBee Hive Border Router for Wi-SUN digi_international:xbee_hive_border_router_for_wi_sun (from the name) | from 21.8.24.139 through 26.7.90.14 | CNA record |
Digi International Digi 54xx Family digi_international:digi_54xx_family (from the name) | through 21.8.24.139 | CNA record |
Digi International Digi 63xx Family digi_international:digi_63xx_family (from the name) | from 21.8.24.139 through 22.5.50.66 | CNA record |
Digi International Digi IX14 digi_international:digi_ix14 (from the name) | from 21.8.24.139 through 22.5.50.62 | CNA record |
Digi International Digi LR54 Family digi_international:digi_lr54_family (from the name) | from 21.8.24.139 through 23.12.1.56 | CNA record |
References
- https://www.digi.com/resources/securitymitigation, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.