CVE-2021-36767
📋 TL;DR
CVE-2021-36767 is an authentication bypass vulnerability in Digi RealPort software where the challenge-response mechanism leaks a weakly-hashed server password. Attackers can send unauthenticated requests to obtain this hash, crack it offline, and gain unauthorized access. This affects all Digi RealPort installations through version 4.10.490.
💻 Affected Systems
- Digi RealPort
📦 What is this software?
Connectport Lts 8\/16\/32 Firmware by Digi
View all CVEs affecting Connectport Lts 8\/16\/32 Firmware →
Passport Integrated Console Server Firmware by Digi
View all CVEs affecting Passport Integrated Console Server Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Digi RealPort server allowing attackers to intercept, modify, or block serial communications, potentially disrupting industrial control systems or critical infrastructure.
Likely Case
Unauthorized access to serial port communications, data exfiltration, or service disruption for connected devices.
If Mitigated
Limited impact if network segmentation prevents external access and strong authentication controls are in place elsewhere.
🎯 Exploit Status
Exploitation requires only network access to the RealPort server and basic hash cracking tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.10.491 and later
Vendor Advisory: https://www.digi.com/resources/security
Restart Required: Yes
Instructions:
1. Download latest version from Digi support portal. 2. Backup configuration. 3. Install update. 4. Restart RealPort service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to RealPort servers using firewalls or network ACLs.
Disable Unused Services
windowsDisable RealPort services on systems where they are not required.
sc stop RealPort
sc config RealPort start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate RealPort servers from untrusted networks
- Monitor for unauthorized access attempts and implement multi-factor authentication where possible
🔍 How to Verify
Check if Vulnerable:
Check RealPort version in About dialog or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Digi International\RealPort\VersionCheck Version:
reg query "HKLM\SOFTWARE\Digi International\RealPort" /v VersionVerify Fix Applied:
Verify version is 4.10.491 or higher and test authentication with invalid credentials.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful login
- Multiple connection attempts from single IP
Network Indicators:
- Unusual traffic patterns to RealPort default port 771
- Unauthorized access to serial port resources
SIEM Query:
source="RealPort" AND (event_type="authentication" AND result="success") AND src_ip NOT IN allowed_ips