CVE-2026-75937CWE-78command-injection

CVE-2026-75937

published October 3, 2026

CVSS
9.4
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
9.4 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00528 · 43.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-03T01:16Z
References (1)
https://www.digi.com/resources/security · e8a6bb0b-e373-42b1-a5de-93e314325576
EPSS history
Timeline
  • 04 OCT 03:31Z
    EPSS moved — → 1%
    epss
  • 02 OCT 20:33Z
    OS Command Injection in Digi Accelerated Linux (DAL OS)
    cvelistv5