CVE-2026-75937 CRITICAL

CVE-2026-75937: OS Command Injection in Digi Accelerated Linux (DAL OS)

Vendor Digi International
Product IX Family
Weakness CWE-78
Published October 2, 2026
Last update October 3, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Key dates

02Disclosure timeline

October 2, 2026 CVE published
October 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-2662 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection CVE-2021-24684 PDF Light Viewer < 1.4.12 - Authenticated Command Injection CVE-2025-12122 Popup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2019-25224 WP Database Backup < 5.2 - Unauthenticated OS Command Injection CVE-2024-49281 WordPress Click to Chat – WP Support All-in-One Floating Widget plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability