Cyber Resilience

CVE-2023-4299

Digi Realport ≤ 1.9-40

Published
31 August 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 9.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0055 43th percentile
Risk Priority 64 floored blend · peak EPSS

Summary

CVE-2023-4299 is a critical-severity Use of Password Hash Instead of Password for Authentication (CWE-836) vulnerability in Digi Realport. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Pass the Hash (T1550.002); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

CWE(s)
CWE-836

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.002 Pass the Hash Lateral Movement
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.
attack.mitre.org →
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-64471Shared CWE-836
CVE-2026-9222Shared CWE-836
CVE-2019-25552Shared CWE-836
CVE-2023-39546Shared CWE-836
CVE-2025-48925Shared CWE-836
CVE-2025-52543Shared CWE-836
CVE-2026-40103Shared CWE-836
CVE-2023-34132Shared CWE-836
CVE-2024-50628Same vendor: Digi
CVE-2024-50627Same vendor: Digi

Affected Assets

digi
realport
≤ 1.9-40 · ≤ 4.8.488.0
digi
connectport ts 8\/16 firmware
≤ 2.26.2.4
digi
passport firmware
all versions
digi
connectport lts 8\/16\/32 firmware
≤ 1.4.9
digi
cm firmware
all versions
digi
portserver ts firmware
all versions
digi
portserver ts mei firmware
all versions
digi
portserver ts mei hardened firmware
all versions
digi
portserver ts m mei firmware
all versions
digi
portserver ts p mei firmware
all versions
+10 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.17 Authentication information full match
degrades

Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.

A.8.5 Secure authentication full match
degrades

Mandates secure authentication mechanisms that preclude the flawed practice of treating password hashes as authenticators.

A.8.24 Use of cryptography partial match
degrades

Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.

A.8.28 Secure coding partial match
prevents

Secure coding guidance can prevent this implementation error but does not address the control's broader intent.

References