PT-2026-56193 · Digi · One Sp Ia+3
CVE-2026-12948
·
Published
2026-07-07
·
Updated
2026-07-09
CVSS v4.0
4.8
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Digi PortServer TS (affected versions not specified)
Digi One SP (affected versions not specified)
Digi One SP IA (affected versions not specified)
Digi One IA (affected versions not specified)
Description
A stored cross-site scripting (XSS) issue exists in the web management interface. This allows a remote, authenticated administrator to inject scripts into specific system configuration fields. These scripts are then executed in the browser of any user who accesses the affected pages.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
One Ia
One Sp
One Sp Ia
Portserver Ts