NVD Vulnerability Detail

CVE-2021-37187

Summary	An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords.
Publication Date	Dec. 10, 2021, 10:15 p.m.
Registration Date	Dec. 11, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:14 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_dr64_firmware::::::::			5.2.4.9
execution environment
1	cpe:2.3:h:digi:transport_dr64:-:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_dr64_firmware:-:::::::*
execution environment
1	cpe:2.3:h:digi:transport_sr44:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_vc74_firmware::::::::			5.2.4.9
execution environment
1	cpe:2.3:h:digi:transport_vc74:-:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_wr11_firmware::::::::			8.2.1.3
execution environment
1	cpe:2.3:h:digi:transport_wr11:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_wr11_xt_firmware::::::::			8.2.1.3
execution environment
1	cpe:2.3:h:digi:transport_wr11_xt:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_wr21_firmware::::::::			8.2.1.3
execution environment
1	cpe:2.3:h:digi:transport_wr21:-:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_wr31_firmware::::::::			8.2.1.3
execution environment
1	cpe:2.3:h:digi:transport_wr31:-:::::::*

Configuration8		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_wr41_firmware::::::::		5.0.0.0	5.2.4.6
cpe:2.3:o:digi:transport_wr41_firmware::::::::		6.0.0.0	6.1.3.5
cpe:2.3:o:digi:transport_wr41_firmware::::::::		8.0.0.0	8.3.1.2
execution environment
1	cpe:2.3:h:digi:transport_wr41:-:::::::*

Configuration9		or higher	or less	more than	less than
cpe:2.3:o:digi:transport_wr44_firmware::::::::			8.3.1.2
execution environment
1	cpe:2.3:h:digi:transport_wr44:v2:::::::*

Related information, measures and tools

No	URL	タグ
1	https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt	Third Party Advisory
2	https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt	Third Party Advisory
3	https://www.digi.com/search/results?q=transport	Vendor Advisory
4	https://www.digi.com/search/results?q=transport	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-522	認証情報の不十分な保護	https://cwe.mitre.org/data/definitions/522.html

JVN Vulnerability Information

複数の Digi International Inc. 製品における認証情報の不十分な保護に関する脆弱性

Title	複数の Digi International Inc. 製品における認証情報の不十分な保護に関する脆弱性
Summary	TransPort DR64 ファームウェア、TransPort VC74 ファームウェア、TransPort WR11 ファームウェア等複数の Digi International Inc. 製品には、認証情報の不十分な保護に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 10, 2021, midnight
Registration Date	July 17, 2024, 11:05 a.m.
Last Update	July 17, 2024, 11:05 a.m.

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-37187	https://www.cve.org/CVERecord?id=CVE-2021-37187
National Vulnerability Database (NVD)
2	CVE-2021-37187	https://nvd.nist.gov/vuln/detail/CVE-2021-37187

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-522	https://cwe.mitre.org/data/definitions/522.html

その他

No	Name	URL
関連文書
1	raw.githubusercontent.com (2021-04.txt)	https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
2	www.digi.com (results?q=transport)	https://www.digi.com/search/results?q=transport

Change Log

No	Changed Details	Date of change
1	[2024年07月17日] 掲載	July 17, 2024, 11:05 a.m.