CVE-2021-35978
📋 TL;DR
This critical vulnerability in Digi TransPort devices allows remote attackers with knowledge of the ZING protocol to execute arbitrary commands with SUPER privileges. Affected devices include DR64, SR44, VC74, and WR series controllers. Attackers can overwrite firmware, modify users, disable firewalls, and gain complete control of affected systems.
💻 Affected Systems
- Digi TransPort DR64
- Digi TransPort SR44
- Digi TransPort VC74
- Digi TransPort WR
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing firmware replacement, permanent backdoor installation, data exfiltration, and use as pivot point into internal networks.
Likely Case
Unauthorized access leading to configuration changes, user account manipulation, and potential ransomware deployment on industrial control systems.
If Mitigated
Limited impact if devices are behind strict network segmentation with no internet exposure and ZING protocol disabled.
🎯 Exploit Status
Exploitation requires knowledge of ZING protocol but no authentication. Public disclosure includes technical details enabling exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Digi firmware updates for specific version
Vendor Advisory: https://digi.com
Restart Required: Yes
Instructions:
1. Check Digi support portal for latest firmware. 2. Backup current configuration. 3. Apply firmware update via web interface or console. 4. Verify ZING protocol is disabled if not needed. 5. Restart device.
🔧 Temporary Workarounds
Disable ZING Protocol
allDisable the vulnerable ZING protocol if not required for operations
Configuration varies by device - disable via web interface or CLI
Network Segmentation
allIsolate affected devices from untrusted networks
Implement firewall rules blocking port 2362/tcp (ZING default)
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted IPs to communicate with affected devices
- Monitor network traffic for ZING protocol usage and investigate any unexpected connections
🔍 How to Verify
Check if Vulnerable:
Check if ZING protocol is enabled in device configuration and if firmware version is unpatchedCheck Version:
Check via web interface or console: show versionVerify Fix Applied:
Verify firmware version is updated to latest and ZING protocol is disabled📡 Detection & Monitoring
Log Indicators:
- Unexpected ZING protocol connections
- Configuration changes without authorization
- New user account creation
Network Indicators:
- Traffic on port 2362/tcp (ZING default)
- Unusual outbound connections from device
SIEM Query:
source_port:2362 OR protocol:"ZING" OR device_type:"Digi TransPort" AND (event_type:"config_change" OR event_type:"user_added")