CVE-2026-12948 Overview
CVE-2026-12948 is a stored cross-site scripting (XSS) vulnerability affecting the web management interface of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA serial-to-Ethernet devices. A remote, authenticated administrator can inject script payloads into specific system configuration fields. The malicious script executes in the browser of any user who subsequently views the affected pages. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Injected JavaScript executes in the browser context of authenticated users viewing configuration pages, enabling session hijacking, credential theft, or unauthorized device reconfiguration on industrial serial-networking equipment.
Affected Products
- Digi PortServer TS
- Digi One SP and Digi One SP IA
- Digi One IA
Discovery Timeline
- 2026-07-07 - CVE-2026-12948 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-12948
Vulnerability Analysis
The web management interface of the affected Digi device console servers fails to properly sanitize input submitted through certain system configuration fields. An authenticated administrator can supply JavaScript payloads that the application stores in device configuration and later reflects into HTML rendered to browser clients. When any user with access to the management interface loads an affected page, the stored payload executes under the origin of the device's web management console.
The attack requires administrator-level credentials on the device, which limits opportunistic exploitation. However, the persistence of the payload means the impact extends beyond the injecting user. Consequences include theft of session tokens, forced execution of privileged configuration changes, and pivoting into operational technology (OT) networks where these serial servers commonly bridge legacy equipment.
The EPSS probability is 0.269%, indicating low near-term exploitation likelihood in the wild.
Root Cause
The root cause is missing output encoding and insufficient input validation on configuration fields exposed by the web management interface. User-supplied data is stored and later rendered into HTML pages without contextual escaping, allowing <script> tags and event-handler attributes to be interpreted as executable code by client browsers.
Attack Vector
Exploitation requires network access to the device's web management interface and valid administrator credentials. The attacker authenticates, navigates to a vulnerable configuration field, and submits a payload containing JavaScript. When another administrator or operator later views a page that reflects that field, the browser parses and executes the injected script within the device's web origin. User interaction from a second victim is required for the payload to trigger.
No verified public exploit code is available. The vulnerability mechanism is described in prose only. See the Digi Security Resources advisory for vendor-specific technical details.
Detection Methods for CVE-2026-12948
Indicators of Compromise
- Unexpected <script>, onerror=, onload=, or javascript: strings present in stored device configuration fields such as device names, descriptions, port labels, or contact information.
- Outbound HTTP requests from administrator browsers to unfamiliar external hosts immediately after loading Digi web management pages.
- Unexpected configuration changes performed under an administrator session shortly after another administrator viewed a configuration page.
Detection Strategies
- Inspect stored configuration exports from Digi PortServer TS and Digi One devices for HTML or JavaScript syntax in fields that should contain only plain text.
- Deploy a web proxy or browser isolation policy in front of device management interfaces and log page contents for signature-based XSS detection.
- Correlate administrator authentication events with subsequent configuration write operations to identify script-driven changes.
Monitoring Recommendations
- Log and alert on all authenticated writes to the Digi web management interface, particularly to free-text configuration fields.
- Monitor management VLAN egress traffic for anomalous outbound connections originating from administrator workstations.
- Track administrator account usage on OT-adjacent devices and flag logins from unexpected source addresses or times.
How to Mitigate CVE-2026-12948
Immediate Actions Required
- Restrict access to the Digi web management interface to a dedicated management network reachable only by authorized administrator workstations.
- Audit all configuration fields on affected devices for existing script content and remove any suspicious entries.
- Rotate administrator credentials on affected Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA devices.
Patch Information
Refer to the Digi Security Resources page for vendor advisories, firmware updates, and mitigation guidance specific to affected device models. Apply firmware updates released for CVE-2026-12948 as soon as they are available through official Digi distribution channels.
Workarounds
- Disable the HTTP/HTTPS web management interface where possible and administer devices via serial console or SSH command-line.
- Enforce network-layer access control lists so that only hardened jump hosts can reach the device management ports.
- Use browsers with strict Content Security Policy enforcement or dedicated administrative browser profiles when managing affected devices.
# Example: restrict management access using an upstream firewall ACL
# Allow only the admin jump host to reach the Digi device web UI
iptables -A FORWARD -s 10.10.0.25/32 -d 192.0.2.10/32 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10/32 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.10/32 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
