nvicloud/cve-2026-12948Proof of concept for stored XSS in Digi PortServer TS 4 H MEI web interface, demonstrating persistent payload execution and providing remediation guidance.
A stored cross-site scripting (XSS) vulnerability was identified in the web management interface of the Digi PortServer TS 4 H MEI. A specially crafted, authenticated request allows a script payload to be permanently written to device configuration storage. The payload persists across logout/login cycles and device reboots, and executes in the browser of any user who subsequently views the affected configuration pages.
| Product | Firmware Tested |
|---|
| Digi PortServer TS 4 H MEI | 82000747_V1 (02/06/2012) |
| Digi PortServer TS 4 H MEI | 82000747_AB (04/09/2025) |
Multiple unsanitized input fields in the device's configuration forms were found to store and later reflect unescaped script content, including:
btRefresh — connections management form (/Forms/connections_mgmt_1)
txtDevice, txtContact, txtLocation — system configuration form (/Forms/system_config_1)
Payloads were submitted as authenticated POST requests to the affected forms, e.g.:
POST /Forms/system_config_1 HTTP/1.1
Host: [device-ip]
Authorization: Basic [BASE64_CREDENTIAL]
Content-Type: application/x-www-form-urlencoded
... content snipped ...
txtDevice=[Vulnerable_Parameter]&txtContact=[Vulnerable_Parameter]&txtLocation=[Vulnerable_Parameter]&selOptimization=1&Submit=Apply
Verified behavior:
POST /Forms/connections_mgmt_1 HTTP/1.1
Host: [device-ip]
Content-Length: 17
Authorization: Basic [BASE64_CREDENTIAL]
... content snipped ...
btRefresh=[Vulnerable_Parameter]
Verified behavior:
<, >, ", ', &) to their HTML entity equivalents before the page is rendered.