CVE-2021-35977
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of Digi RealPort for Windows. The buffer overflow occurs when processing ADDP discovery response messages, potentially giving attackers full system control. Organizations using Digi RealPort for Windows through version 4.8.488.0 are affected.
💻 Affected Systems
- Digi RealPort for Windows
📦 What is this software?
Connectport Lts 8\/16\/32 Firmware by Digi
View all CVEs affecting Connectport Lts 8\/16\/32 Firmware →
Passport Integrated Console Server Firmware by Digi
View all CVEs affecting Passport Integrated Console Server Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Remote code execution leading to system takeover, lateral movement within networks, and potential data exfiltration.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls, potentially only denial of service.
🎯 Exploit Status
The vulnerability requires sending specially crafted ADDP discovery response messages to vulnerable systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.489.0 and later
Vendor Advisory: https://www.digi.com/resources/security
Restart Required: Yes
Instructions:
1. Download latest Digi RealPort installer from Digi website. 2. Uninstall current version. 3. Install updated version 4.8.489.0 or later. 4. Restart system.
🔧 Temporary Workarounds
Block ADDP Traffic
windowsBlock ADDP protocol traffic (UDP port 2362) at network perimeter and between network segments.
Windows Firewall: netsh advfirewall firewall add rule name="Block ADDP" dir=in action=block protocol=UDP localport=2362
netsh advfirewall firewall add rule name="Block ADDP Out" dir=out action=block protocol=UDP remoteport=2362
Disable ADDP Discovery
windowsDisable ADDP discovery feature in Digi RealPort configuration if not required.
🧯 If You Can't Patch
- Segment networks to isolate Digi RealPort systems from untrusted networks
- Implement strict firewall rules to allow ADDP traffic only from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check Digi RealPort version in Control Panel > Programs and Features. If version is 4.8.488.0 or earlier, system is vulnerable.Check Version:
wmic product where "name like 'Digi RealPort%'" get versionVerify Fix Applied:
Verify installed version is 4.8.489.0 or later in Control Panel > Programs and Features.📡 Detection & Monitoring
Log Indicators:
- Multiple ADDP protocol errors or crashes in Digi RealPort logs
- Windows Event Logs showing application crashes for Digi RealPort
Network Indicators:
- Unusual ADDP traffic patterns, especially large ADDP packets
- ADDP traffic from unexpected sources
SIEM Query:
source="windows" AND (event_id=1000 OR event_id=1001) AND process_name="RealPort.exe"