A specially crafted HTTP POST request sent to the web administration interface of Digi Accelerated Linux (DAL OS) devices can be used by an attacker without authentication to execute arbitrary operating system commands with root privileges. This capability amounts to full remote code execution and allows compromise of confidentiality, integrity, and availability of the device and any connected network.

The vulnerability affects several Digi International product families including AnywhereUSB Plus, Connect EZ, Connect IT, Digi 54xx, Digi 63xx, Digi IX14, Digi LR54, EX, IX, TX, XBee Hive Border Router for Wi‑SUN, and XBee Hive Gateway running DAL OS. Affected versions are not listed in the provided data, so any firmware running on these families prior to a fix may be vulnerable.

The CVSS base score of 9.4 indicates critical severity. The lack of an EPSS score means there is no current data on exploit probability, but the ability to execute commands as root without authentication makes the vulnerability highly damaging. The vulnerability is not listed in the CISA KEV catalogue, but the lack of exposure controls means attackers could reach the web interface from any network that can reach the device. Exploitation would involve sending a crafted POST request to the device’s web UI, bypassing authentication, and running payload commands with root privileges.