CVE-2026-12352
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and gain access to restricted resources, obtain credentials, and inject malicious scripts. The following versions of Digi International PortServer TS, Digi One SP IA are affected: PortServer TS Digi One SP Digi One SP IA Digi One IA CVSS Vendor Equipment Vulnerabilities v3 5.9 Digi International Digi International PortServer TS, Digi One SP IA Incorrect Authorization, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Background Critical Infrastructure Sectors: Critical Manufacturing, Communications, Information Technology, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-12352 The vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device. View CVE Details Affected Products Digi International PortServer TS, Digi One SP IA Vendor: Digi International Product Version: Digi International PortServer TS: <Firmware_2025, Digi International Digi One SP: <Firmware_2025, Digi International Digi One SP IA: <Firmware_2025, Digi International Digi One IA: <Firmware_2025 Product Status: known_affected Remediations Mitigation Digi International recommends users upgrade to Digi Connect EZ or Digi Connect EZ TS as a long term solution. If users are not able to upgrade at this time, the following actions should be taken: Vendor fix For Digi PortServer TS: Enable HTTPS on the web server. Mitigation Alternatively, disable the web server when it is not actively being used for configuration. Mitigation Compensating control: If you cannot apply the HTTPS configuration, restrict access via firewall or VPN. Vendor fix For Digi One SP / Digi One SP IA / Digi One IA: Disable the web server. If you cannot apply the HTTPS configuration, restrict access via firewall or VPN. Mitigation The fo
CSIRTS triage
- What
- Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and inject malicious scripts.
- Who is affected
- Users of Digi International PortServer TS and Digi One SP IA.
- Urgency
- Remediation is critical due to the potential for unauthorized access and exploitation.
- Action
- Apply the necessary updates to mitigate the vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-12352
Get an email if CVE-2026-12352 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
Advisory coverage (2)
- mediumCVE-2026-12352: This vulnerability allows an unauthenticated actor to bypass authentication and gain access to…nvd · 2026-07-07
- criticalDigi International PortServer TS, Digi One SP IAcisa · 2026-07-07
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-12352)