CVE-2026-12948 — Stored Cross-Site Scripting (XSS)

Description (CNA)

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).

Affected (CNA)

Vendor / product	Versions
Digi International / Digi PortServer TS	affected 82000747_V1 through 82000747_AB
Digi International / Digi One SP	affected 82000774_Z through 82000774_AB
Digi International / Digi One SP IA	affected 82000774_Z through 82000774_AB
Digi International / Digi One IA	affected 82000774_Z through 82000774_AB

CWE

CWE-79

References

https://www.digi.com/resources/security

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.