Stored XSS Vulnerability in Digi PortServer and Digi One Products
CVE-2026-12948

4.8MEDIUM

Key Information:

Vendor: Digi International
Status: Digi Portserver Ts; Digi One Sp; Digi One Sp Ia; Digi One Ia
Vendor: CVE Published:; 7 July 2026

🔔 Create Digi International Vulnerability Alert

What is CVE-2026-12948?

A stored cross-site scripting vulnerability exists in the web management interface of Digi's PortServer TS and One product line. This flaw allows a remote, authenticated administrator to inject malicious scripts into specific configuration fields. When users access the affected pages, the injected scripts execute in their browsers, potentially compromising user sessions and sensitive data.

Affected Version(s)

Digi One IA 82000747_V1 <= 82000747_AB

Digi One SP 82000747_V1 <= 82000747_AB

Digi One SP IA 82000747_V1 <= 82000747_AB

References

https://www.digi.com/resources/security

CVSS V4

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 7, 2026
Vulnerability Reserved
Jun 22, 2026

CVE-2026-12948 Data

JSON