The above payloads alone will not cause enough stress on the target. This was accomplished with double encoding, utilizing the below procedures.

• 'Payload encoding' > URL encoding of special characters.
• 'Payload Processing' > URL-encode all characters.

Vulnerability Details

Requests to GET /FS/<payload>/config.xml normally return 401 Unauthorized. When the same request is sent at low concurrency (1 thread, 1s delay), the device consistently and correctly rejects the request pre-auth.

As concurrency increases (tested at 5, 6, 10, and 20 concurrent requests), the device begins intermittently returning HTTP/0.9 responses (no headers, body only) containing the full contents of config.xml — served without any authentication challenge. This indicates the firmware's HTTP handler has a fixed request-processing capacity that, once exceeded, allows requests to bypass the authentication check entirely.

The disclosed configuration file includes:

• Device brand, model, and firmware version
• Network configuration (gateway, DNS, TFTP/boot server, active services and ports: RealPort, Telnet, SNMP, HTTP/HTTPS, rlogin, rsh, LPD, RADIUS)
• Configured console/terminal user accounts and permissions
• RADIUS shared secrets in plaintext

Remediation

• Digi PortServer TS: Enable HTTPS on the web server, or disable the web server when not actively in use for configuration.
• Digi One SP / SP IA / IA: Disable the web server.
• Compensating control: If the above cannot be applied, restrict device access via firewall or VPN.

References

• Vendor advisory: Digi Security Advisory — Incorrect Authorization
• CISA ICS Advisory: ICSA-26-188-07
• NVD: CVE-2026-12352

Disclosure Timeline

• Reported to Digi via coordinated disclosure with MITRE/CISA coordination
• CVE-2026-12352 assigned
• Public advisory published by Digi International and CISA