CVE-2024-50625

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:digi:connectport_lts_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:digi:connectport_lts_16:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_16_mei:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_16_mei_2ac:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_32:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_32_mei:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_8_mei:-:*:*:*:*:*:*:*

History

27 Jun 2025, 16:07

Type Values Removed Values Added
First Time Digi connectport Lts 32 Mei
Digi connectport Lts 32
Digi connectport Lts Firmware
Digi
Digi connectport Lts 16 Mei
Digi connectport Lts 16
Digi connectport Lts 8 Mei
Digi connectport Lts 16 Mei 2ac
References () https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf - () https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf - Vendor Advisory
References () https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - () https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - Product
References () https://www.digi.com/resources/security - () https://www.digi.com/resources/security - Vendor Advisory
CPE cpe:2.3:h:digi:connectport_lts_32:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_16:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_16_mei_2ac:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_16_mei:-:*:*:*:*:*:*:*
cpe:2.3:o:digi:connectport_lts_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_32_mei:-:*:*:*:*:*:*:*
cpe:2.3:h:digi:connectport_lts_8_mei:-:*:*:*:*:*:*:*

12 Dec 2024, 02:06

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.0
Summary
  • (es) Se descubrió un problema en Digi ConnectPort LTS anterior a la versión 1.4.12. Una vulnerabilidad en el manejo de carga de archivos de una aplicación web permite la manipulación de rutas de archivos mediante solicitudes POST. Esto puede provocar cargas de archivos arbitrarias dentro de directorios específicos, lo que potencialmente permite la escalada de privilegios cuando se combina con otras vulnerabilidades.
CWE CWE-434

09 Dec 2024, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-12-09 22:15

Updated : 2025-06-27 16:07


NVD link : CVE-2024-50625

Mitre link : CVE-2024-50625

CVE.ORG link : CVE-2024-50625


JSON object : View

Products Affected

digi

  • connectport_lts_32
  • connectport_lts_16_mei
  • connectport_lts_16
  • connectport_lts_8_mei
  • connectport_lts_16_mei_2ac
  • connectport_lts_firmware
  • connectport_lts_32_mei
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type