Digi Accelerated Linux (DAL OS): OS command injection in web administration

Summary

Digi Accelerated Linux (DAL OS) on several Digi routers, console servers, hubs and XBee gateways contains an OS command injection flaw in the web administration interface. An unauthenticated attacker who can send a crafted HTTP POST request to that interface can run arbitrary operating system commands with root privileges. The CVSS 4.0 score is 9.4 (critical), and the attack requires network access to the web interface, which by default is limited to the local LAN.

Affected

• IX, EX, TX, Connect IT, AnywhereUSB Plus, Connect EZ, XBee Hive Gateway and XBee Hive Border Router for Wi-SUN: DAL OS 21.8.24.139 to 26.7.90.14 (per CVE record)
• Digi 54xx: DAL OS up to 21.8.24.139 (per CVE record)
• Digi 63xx: DAL OS 21.8.24.139 to 22.5.50.66 (per CVE record)
• Digi IX14: DAL OS 21.8.24.139 to 22.5.50.62 (per CVE record)
• Digi LR54: DAL OS 21.8.24.139 to 23.12.1.56 (per CVE record)

Fixed in

• Fixed versions are reported by secondary sources only and must be confirmed on Digi's advisory:
• 26.2.148.166 LTS or 26.7.90.15 for most IX, EX, TX and Connect IT models
• 26.2.148.166 LTS for AnywhereUSB Plus and Connect EZ
• 26.9.10.28 for XBee Hive gateways and IX15
• 54xx, 63xx, IX14 and LR54: end of life, no fix expected
• TX40 and EX50: unknown, no confirmed fixed build found

Workaround

• Disable the web server on devices that are not being actively configured (vendor guidance in the CVE record).
• Restrict access to the web interface to the local LAN and close any port forwards, VPN routes or WAN exposure.
• Check Digi Remote Manager templates, which can re-enable the web service, and change them.
• Replace or isolate end-of-life models (54xx, 63xx, IX14, LR54) if no fix is available.

Exploitation

• No public proof-of-concept reported at publication.
• No confirmed in-the-wild exploitation found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Not listed in the CISA KEV catalog (per OpenCVE).

Our recommendation

• Inventory all Digi DAL OS devices and their firmware versions, and identify end-of-life models.
• Check whether the web interface is reachable from outside the local LAN and close that path now.
• Disable the web server on devices not being configured, and review Remote Manager templates.
• Apply the fixed firmware per model once confirmed on Digi's advisory; confirm TX40 and EX50 status with Digi support.
• Rotate admin passwords on patched devices and on any system that reused them.
• Monitor Digi's security page and CISA for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Digi Security Center www.digi.com
• OpenCVE: CVE-2026-75937 app.opencve.io
• Version matrix across DAL OS (dev.to) dev.to
• Why a management interface decides the risk (dev.to) dev.to
• Patch planning for Digi DAL OS fleets (dev.to) dev.to
• Digi DAL OS vulnerability (SecurityOnline) securityonline.info
• Digi releases DAL OS firmware (5GStore) 5gstore.com
• OffSeq Radar: CVE-2026-75937 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:14.