Digi Security Center

After a detailed investigation, Digi has determined Apache Log4j CVE-2021-44228 does not impact many of our products/product families. The unaffected products are listed below.

If you do not find a product, please note that we are continuing internal testing and will update the list below as soon as the results are known.

Devices not impacted by Apache Log4j CVE-2021:

• CTEK G6200 family
• CTEK SkyCloud
• CTEK Z45 family
• Digi 54xx family
• Digi 63xx family
• Digi AnywhereUSB (G2) family
• Digi AnywhereUSB Plus family
• Digi Connect family
• Digi Connect EZ family
• Digi Connect IT family
• Digi ConnectPort family
• Digi ConnectPort LTS family
• Digi Connect Sensor family
• Digi Connect WS family
• Digi Embedded Android
• Digi Embedded Yocto
• Digi EX routers
• Digi IX routers
• Digi LR54
• Digi One family
• Digi Passport family
• Digi PortServer TS family
• Digi TX routers
• Digi WR11
• Digi WR21
• Digi WR31
• Digi WR44R/RR
• Digi WR54
• Digi WR64

Software/Management Platforms:

• AnywhereUSB Manager
• Aview
• ARMT
• AVWOB
• Digi Navigator
• Digi Remote Manager
• Digi Xbee mobile app
• Lighthouse
• Realport
• Remote Hub Config Utility

Apache Log4j CVE-2021-44228 vulnerability

FragAttacks - WiFi Fregmentation and Aggregation Attacks

At this time, Digi is still reviewing these attacks and how they impact our devices. From the nature of the attacks, we do expect that Digi devices will be impacted.

However, it is critical to note that even with these attacks, it has always been DIgi's policy and suggestions that network communication should never rely on the protections and standards of the data layers (WiFi/BlueTooth). Many of these are implemented in HW and can be difficult to change. If good network practices are used, (TLS/Certificates etc), then these vulnerabilities do not lead to any real impact. These vulnerabilites can only become impactful IF other flaws or issues are present.

It is Digi's intent to address these issues so that we preserve our defense in depth strategy to security in our products. Due to the complexity of these issues, we believe we will be able to address these by Q4 of 2021 or sooner if possible.

AMNESIA:33 - VU#815128 - Multiple TCP/IP stacks used in Internet of Things (IoT have several vulnerabilities stemming from improper memory management.

RIPPLE20 - Multiple vulnerabilities in TRECK TCP/IP embedded software - VU#257161

• Digi Connect® ME, Digi Connect® EM, Digi Connect® WME, Digi Connect® SP, and Digi Connect® ES; Digi Connect® 9C, Digi Connect® 9P;
• Digi ConnectPort® TS, Digi ConnectPort® X2, Digi ConnectPort® X4;
• Digi AnywhereUSB® (First and Second Gen, NOT Plus);
• NetSilicon 7250, 9210, 9215, 9360, 9750;
• Any products using the NET+OS 7.X development environments.

Reflection attack WR11,WR21,WR31,WR41,WR44 series routers - VU#636397 - CVE-2020-10136

A high level vulnerability (CVSS => 7.0) was discovered on the Digi WR11,WR21,WR31,WR41, and WR44 cellular routers. The attack allows IP-in-IP encapsulation to be used to route arbitrary network traffic through a vulnerable device.

Please download firmware V8.1.0.1 (or greater) for a fix for this issue. Alternatively, enabling the firewall feature on the devices WAN interface (or cellular interface) port will also mitigate this attack.

For more information on this vulnerability, please see the knowledge base article within the Digi support section

Randomization of Secure Session SRP ephemeral values

A vulnerability was discovered on Digi XBee 3 Zigbee and Digi XBee 3 802.15.4 firmwares where the ephemeral values used for Secure Session SRP authentication are not randomized unless BLE is enabled. This feature is typically used to secure networks against unauthorized remote configuration.

For more information, go to: https://www.digi.com/support/knowledge-base/xbee-3-%E2%80%93-secure-session-srp-randomization

Zigbee transport keys sent 'in the clear'

A vulnerability was discovered on earlier generation XBee ZigBee modules (S2B, S2C, and S2D) where a router that was previously associated with the network can be allowed back onto the secured network using an invalid preconfigured link key. After which, this node could inadvertently pass the network key "in the clear" to devices attempting to join through it.

For more information, go to: https://www.digi.com/support/knowledge-base/xbee-zigbee-keys-can-be-sent-in-the-clear

Digi ConnectPort LTS vulnerabilities - 1 unrestricted upload, and 3 stored cross site scripting vulnerabilities - ICS Advisory (ICSA-20-042-13)

Vulnerability researchers Murat Aydemir, and Fatih Kayran discovered the above vulnerabilities within the ConnectPort LTS web interface of  the Digi ConnectPort LTS firmware. The suggested fix for these issues include an update of firmware to the latest release for your product. For the full US-CERT guidance, please see: https://www.us-cert.gov/ics/advisories/icsa-20-042-13

For firmware updates, go to: https://www.digi.com/support/supporttype?type=firmware

"SACK" Vulnerability - (CVE-2019-11477, CVE-2019-11478, CVE-2019-5599 and CVE-2019-11479)

Digi LR54/WR64/WR54 CVE-2018-20162 Major Security Vulnerability – Restricted Shell escape

libSSH Critical vulnerability : CVE-2018-10933

Spectre and Meltdown Vulnerabilities - (CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754)

Digi is aware of the Spectre and Meltdown vulnerabilities that were recently released. These vulnerabilities impact the confidentiality of data running on Intel, AMD and ARM processors.

For Digi hardware products, we do not use Intel or AMD processors, and as a consequence the "Meltdown" vulnerability does not affect Digi hardware products.

For the Spectre vulnerability, Digi security teams are working to determine the practical impacts and patches on Digi hardware products that use ARM processors.

For Digi Remote Manager & Device Cloud, we are working with our providers to address Spectre and Meltdown.

Additional information will be provided as soon as it is available. For more information on these vulnerabilities, please see the website https://meltdownattack.com/

Please continue to check this space for updates, or subscribe to the RSS feed above.

Discovered vulnerabilities with TransPort WR Series cellular routers

Three vulnerabilities have been found by Kasperski Labs within the WR series transport routers. These vulnerabilities are rated from high to low. The impacted devices are the Digi TransPort WR11,WR21,WR41,WR44, and the WR31. This includes "R", and "RR" versions as well. Impacted vulnerable services are SNMP, FTP, and the command line interface. For more information on the discovered vulnerabilities, including patches, mitigations, and overall risk, please see the knowledge base article.

Blueborne Vulnerability

DNSmasq Network service (CVE-2017-14491)

KRACK Attack

Mirai Botnet Impact Investigations

Practical exploits to SHA1 hashing has now been discovered

OpenSSL - New Security Release 1.1.0c

Dirty COW - (CVE-2016-5195)