Digi ConnectPort LTS (before 1.4.12): An attacker who can reach the ConnectPort LTS's file-upload feature

Impact

An attacker who can reach the ConnectPort LTS's file-upload feature with only limited/local-network privileges can upload and execute a malicious file, escalating straight to full control of the device — which puts them on the cellular/serial gateway path some fleets use for out-of-band access when the primary network is down.

Who can reach it

Requires local-area-network reach to the device's web upload feature and some baseline permission level (not full admin); no internet-facing exposure needed if the device is on a segmented OOB VLAN, but that's exactly the network this appliance is meant to be reachable from.

What to do

Software upgrade to ConnectPort LTS firmware 1.4.12 or later. This is a firmware flash per unit; because ConnectPort LTS is frequently the fallback OOB path when the primary network is unavailable, schedule the upgrade during planned maintenance rather than waiting for an outage to force it.

References