CVE-2025-3659 Overview
CVE-2025-3659 is a critical authentication bypass vulnerability affecting multiple Digi International industrial networking device families. The vulnerability stems from improper authentication handling in a set of HTTP POST requests to the device's web interface. An unauthenticated attacker with adjacent network access can exploit this flaw to modify device configuration settings without proper authorization, potentially compromising critical industrial infrastructure.
Critical Impact
Unauthenticated attackers on the adjacent network can modify device configurations, potentially disrupting industrial operations, enabling persistent access, or creating conditions for further network compromise.
Affected Products
- Digi PortServer TS - prior to and including firmware 82000747_AA (build date 06/17/2022)
- Digi One SP / Digi One SP IA / Digi One IA - prior to and including firmware 82000774_Z (build date 10/19/2020)
- Digi One IAP - prior to and including firmware 82000770 Z (build date 10/19/2020)
Discovery Timeline
- May 12, 2025 - CVE-2025-3659 published to NVD
- May 13, 2025 - Last updated in NVD database
Technical Details for CVE-2025-3659
Vulnerability Analysis
This authentication bypass vulnerability (CWE-287) affects the web management interface of Digi's industrial serial-to-Ethernet device families. The core issue lies in improper validation of authentication credentials when processing certain HTTP POST requests. Instead of consistently enforcing authentication across all configuration endpoints, the affected devices fail to properly verify user credentials for specific POST request handlers, allowing attackers to bypass authentication entirely.
The vulnerability is particularly severe in industrial and operational technology (OT) environments where these device servers are commonly deployed. Digi PortServer TS and Digi One series devices are widely used for connecting serial-based industrial equipment—such as PLCs, sensors, and legacy machinery—to modern IP networks. Unauthorized configuration changes could disrupt critical industrial processes, enable network pivoting, or facilitate persistent backdoor access.
Root Cause
The root cause is an authentication bypass flaw in the HTTP POST request handling logic within the device's embedded web server. Certain configuration modification endpoints do not properly enforce authentication checks, treating requests as authenticated regardless of session state or credential validity. This implementation error allows unauthenticated users to submit configuration changes that should require administrative privileges.
Attack Vector
Exploitation requires adjacent network access to the target device's web interface. An attacker positioned on the same network segment—whether through physical access, compromised network equipment, or wireless network intrusion—can craft malicious HTTP POST requests to modify device settings. The attack does not require any prior authentication or user interaction.
The attacker would identify vulnerable Digi devices on the network, then submit specially crafted POST requests to configuration endpoints that lack proper authentication enforcement. Successful exploitation grants the ability to alter network configurations, serial port settings, authentication credentials, or other device parameters.
Since no verified code examples are available for this vulnerability, technical exploitation details can be found in the Digi Security Alert PDF published by the vendor. The vulnerability manifests as a failure to validate authentication state before processing configuration change requests via HTTP POST methods.
Detection Methods for CVE-2025-3659
Indicators of Compromise
- Unexpected configuration changes on Digi PortServer TS or Digi One series devices
- Unauthorized HTTP POST requests to device web management interfaces from internal network hosts
- Modified device credentials, network settings, or serial port configurations without administrator action
- Web server access logs showing POST requests to configuration endpoints without preceding authentication
Detection Strategies
- Monitor network traffic for unauthenticated HTTP POST requests to Digi device management interfaces
- Implement network segmentation monitoring to detect anomalous traffic patterns targeting industrial device servers
- Deploy intrusion detection rules for HTTP requests to known Digi configuration endpoints
- Enable and centralize logging from all Digi industrial network devices for security analysis
Monitoring Recommendations
- Establish baseline device configurations and implement change detection mechanisms
- Configure network monitoring tools to alert on any connections to Digi device management ports from unauthorized hosts
- Review device access logs regularly for signs of unauthorized configuration attempts
- Consider placing industrial device servers behind network access control systems that limit management interface exposure
How to Mitigate CVE-2025-3659
Immediate Actions Required
- Identify all Digi PortServer TS, Digi One SP, Digi One SP IA, Digi One IA, and Digi One IAP devices in your environment
- Apply firmware updates from Digi International as they become available for affected products
- Restrict network access to device management interfaces using firewalls, VLANs, or access control lists
- Audit current device configurations for unauthorized changes
Patch Information
Organizations should consult the official Digi security resources for firmware updates that address this vulnerability:
Workarounds
- Isolate affected devices on dedicated network segments with strict access controls until patches can be applied
- Disable web management interfaces if not required for operations, using console/serial management as an alternative
- Implement network-level authentication requirements (802.1X, VPN) before allowing access to device management networks
- Deploy a firewall or access control list to permit management traffic only from authorized administrator workstations
# Example firewall rule to restrict management access (adjust for your environment)
# Allow only trusted management subnet to access Digi device web interface
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.30.100 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.30.100 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.30.100 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.20.30.100 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
