VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 6, 2022· Updated Aug 3, 2024

CVE-2022-26952

CVE-2022-26952

Description

Buffer overflow in Digi Passport firmware's Location header construction allows unauthenticated remote attackers to cause denial of service or possibly execute arbitrary code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Buffer overflow in Digi Passport firmware's Location header construction allows unauthenticated remote attackers to cause denial of service or possibly execute arbitrary code.

Vulnerability

The vulnerability is a buffer overflow in the function responsible for building the HTTP Location header string when an unauthenticated user is redirected to the authentication page. This affects Digi Passport firmware through version 1.5.1.1 [1].

Exploitation

An unauthenticated attacker can trigger the overflow by sending a specially crafted HTTP request that causes the Location header to be constructed with an excessively long string. No authentication or user interaction is required [1].

Impact

Successful exploitation could lead to denial of service or potentially remote code execution. The product is end of life, so full impact details are not available [1].

Mitigation

The Digi Passport product line is end of life and obsolete, with no patches or updates planned. Users are advised to migrate to supported products as recommended by Digi [1].

References
  1. Digi Passport Support Resources

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.