CVE-2026-75937: IX Family 21.8.24.139 through 26.7.90.14; +11 more affected products

Affected technology

IX Family · 21.8.24.139 through 26.7.90.14
Digi International

EX Family · 21.8.24.139 through 26.7.90.14
Digi International

TX Family · 21.8.24.139 through 26.7.90.14
Digi International

Connect IT Family · 21.8.24.139 through 26.7.90.14
Digi International

AnywhereUSB Plus Family · 21.8.24.139 through 26.7.90.14
Digi International

Connect EZ Family · 21.8.24.139 through 26.7.90.14
Digi International

XBee Hive Gateway · 21.8.24.139 through 26.7.90.14
Digi International

XBee Hive Border Router for Wi-SUN · 21.8.24.139 through 26.7.90.14
Digi International

Digi 54xx Family · 0 through 21.8.24.139
Digi International

Digi 63xx Family · 21.8.24.139 through 22.5.50.66
Digi International

Digi IX14 · 21.8.24.139 through 22.5.50.62
Digi International

Digi LR54 Family · 21.8.24.139 through 23.12.1.56
Digi International

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can execute arbitrary operating system commands with root privileges on the affected device. Source advisory’s CVSS 4.0 assessment (base score 9.4/10) rates confidentiality, integrity and availability impact as high.