Digi International PortServer TS, Digi One SP IA

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages. View CVE Details Affected Products Digi International PortServer TS, Digi One SP IA Vendor:Digi International Product Version:Digi International PortServer TS:

MitigationCompensating control: If you cannot apply the HTTPS configuration, restrict access via firewall or VPN. Vendor fixFor Digi One SP / Digi One SP IA / Digi One IA: Disable the web server. If you cannot apply the HTTPS configuration, restrict access via firewall or VPN. MitigationDigi International recommends users perform the following actions regarding XSS: Digi International will not provide a firmware fix for products affected by CVE-2026-12948, which are approaching end-of-life. Digi International recommends users upgrade to the Digi Connect EZ or Digi Connect EZ TS as a long-term solution.

MitigationThe following deployment practices are the recommended means of reducing exposure: Deploy the device on a trusted network segment, not exposed to untrusted or public networks.