All vulnerabilities
CVE-2026-75937

IX Family: OS Command Injection in Digi Accelerated Linux (DAL OS)

Digi International IX Family
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.53%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published2 Oct 2026Updated 3 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Text from CVE List

Affected versions 12

  • IX Familyaffected: 21.8.24.139 through 26.7.90.14CVE List
  • EX Familyaffected: 21.8.24.139 through 26.7.90.14CVE List
  • TX Familyaffected: 21.8.24.139 through 26.7.90.14CVE List
  • Connect IT Familyaffected: 21.8.24.139 through 26.7.90.14CVE List
  • AnywhereUSB Plus Familyaffected: 21.8.24.139 through 26.7.90.14CVE List
  • Connect EZ Familyaffected: 21.8.24.139 through 26.7.90.14CVE List
  • XBee Hive Gatewayaffected: 21.8.24.139 through 26.7.90.14CVE List
  • XBee Hive Border Router for Wi-SUNaffected: 21.8.24.139 through 26.7.90.14CVE List
  • Digi 54xx Familyaffected: all versions through 21.8.24.139CVE List
  • Digi 63xx Familyaffected: 21.8.24.139 through 22.5.50.66CVE List
  • Digi IX14affected: 21.8.24.139 through 22.5.50.62CVE List
  • Digi LR54 Familyaffected: 21.8.24.139 through 23.12.1.56CVE List

References 1