This vulnerability (CVE-2026-12948) involves improper neutralization of input during web page generation (CWE-79) in Digi International Digi PortServer TS and related devices. An authenticated administrator can inject stored malicious scripts into system configuration fields via the web interface. These scripts execute in the context of other users viewing the affected pages, enabling cross-site scripting attacks. The vulnerability affects version =82000747_V1. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An authenticated administrator can inject malicious scripts that execute in the browsers of other users who access the affected configuration pages. This can lead to unauthorized actions performed on behalf of those users or exposure of sensitive information within the web management interface context. The impact is limited by the requirement for authenticated administrator access and the medium CVSS score reflects this.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit administrative access to trusted personnel only and monitor for suspicious activity related to the web management interface. Avoid viewing or interacting with affected configuration pages from untrusted environments.