Security Advisory

CVE-2020-6973: Digi ConnectPort LTS 32 MEI Terminal Server Stored Cross-Site Scripting

Last updated:
  • CVE-2020-6973

CVE-2020-6973 covers multiple stored cross-site scripting vulnerabilities in Digi International's ConnectPort LTS 32 MEI, a serial-over-Ethernet terminal server used to manage banks of RS-232/422/485 serial ports over a network; an authenticated attacker can plant malicious script in the web interface that, per CISA's advisory, causes a denial-of-service condition, and NVD's own Primary analysis scores it 6.2 (medium) on the CVSS v3.1 scale, noticeably higher than the 2.4 CISA itself calculated for the same flaw.

Vulnerability summary

6.2

Medium

0.8%

EPSS score (FIRST)

No

CISA KEV catalog

2020-02-13

Published

Vulnerability ID: CVE-2020-6973 · Source: NVD

Affected components

ComponentCPEVersion range
Digi International ConnectPort LTS 32 MEI terminal servercpe:2.3:o:digi:connectport_lts_32_mei_firmware:1.4.3:*:*:*:*:*:*:*Firmware version 1.4.3 (82002228_K, 08/09/2018) with bios version 1.2; Digi's advisory marks firmware 1.4.5 (released 2019-11-08) as the mandatory fixed release

What does this mean for affected devices?

CVE-2020-6973 (CWE-79, cross-site scripting) affects Digi International's ConnectPort LTS 32 MEI terminal server. NVD's description states: "Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vulnerabilities exist that could allow an attacker to cause a denial-of-service condition" (NVD).

CISA's ICS advisory ICSA-20-042-13 describes the ConnectPort LTS 32 MEI as a device that "provides serial over Ethernet connectivity," and notes it is deployed worldwide across the Commercial Facilities, Critical Manufacturing, Food and Agriculture, Healthcare and Public Health, and Transportation Systems critical infrastructure sectors, with Digi International headquartered in the United States. The advisory, published 2020-02-11, credits researchers Murat Aydemir and Fatih Kayran of Biznet Bilisim A.S. with reporting this issue alongside a related unrestricted file-upload flaw, CVE-2020-6975 (CISA ICS Advisory ICSA-20-042-13).

NVD's own Primary analysis assigns a CVSS v3.1 base score of 6.2 (medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H — network-reachable but requiring high privileges and user interaction, with a scope change that lets the script affect device availability beyond the vulnerable component. CISA's own advisory scores the identical flaw lower, at CVSS v3 2.4 using vector AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L (no scope change, lower availability impact); this page reports NVD's Primary figure of 6.2 rather than CISA's lower in-advisory score (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00831 (57.799th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

Digi's advisory recommends upgrading affected ConnectPort LTS 32 MEI units to the mandatory firmware release 1.4.5 (released 2019-11-08), which fixes this issue and the related CVE-2020-6975 file-upload flaw; in the meantime, CISA recommends minimizing network exposure for the terminal server's management interface, isolating it behind firewalls from business networks, and using a VPN for any remote access.

How to fix this class of issueThis advisory's weakness class is Cross-site scripting (XSS). Our practical guide covers how to detect, fix, verify and disclose it: How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware.

Evidence

  • Digi International ConnectPort LTS 32 MEI, firmware 1.4.3 (bios 1.2), has multiple cross-site scripting vulnerabilities that could allow an attacker to cause a denial-of-service condition. — NVD
  • CISA ICSA-20-042-13 (2020-02-11): ConnectPort LTS 32 MEI provides serial-over-Ethernet connectivity, deployed worldwide across Commercial Facilities, Critical Manufacturing, Food and Agriculture, Healthcare and Public Health and Transportation Systems sectors; reported by Murat Aydemir and Fatih Kayran (Biznet Bilisim A.S.). — CISA ICS Advisory ICSA-20-042-13
  • NVD Primary CVSS v3.1 base score is 6.2, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H; CISA's own in-advisory score for the same CVE is lower, 2.4, vector AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L. — NVD
  • Digi recommends upgrading to the mandatory ConnectPort LTS firmware release 1.4.5, released 2019-11-08, which addresses this issue and the related CVE-2020-6975. — CISA ICS Advisory ICSA-20-042-13
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00831 (57.799th percentile) as of 2026-11-07. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCE — CVSS 9.8, Critical severityCISA KEVCVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2023-46604: Apache ActiveMQ OpenWire RCE, Embedded in Armatura One (KEV, Ransomware) — CVSS 9.8, Critical severityCISA KEVCVE-2023-46604: KEV, ransomware-linked unauthenticated RCE in Apache ActiveMQ's OpenWire marshaller, still being flagged in 2026 as an embedded component in Armatura One access control. NVD, CISA and Apache sourced.CVE-2024-3850: Uniview NVR301-04S2-P4 Network Video Recorder Reflected XSS — CVSS 5.4, Medium severityCVE-2024-3850: an authenticated reflected cross-site scripting flaw in Uniview's NVR301-04S2-P4 network video recorder lets an attacker who tricks a logged-in user into clicking a crafted URL run JavaScript in that user's browser session. NVD Primary CVSS 5.4; CISA ICS advisory ICSA-24-156-01; sourced to NVD and CISA.

Sources

  1. NVD
  2. CISA ICS Advisory ICSA-20-042-13
  3. CISA KEV
  4. FIRST EPSS