Skip to content
OpenAdvisories
Critical ICSA-23-320-01 2 CVEs

Red Lion Sixnet RTUs

Published Nov 16, 2023 · Updated Nov 16, 2023

Vendor: Red Lion Product: ST-IPm-6350 Product: ST-IPm-8460 Product: VT-IPm2m-113-D Product: VT-IPm2m-213-D Product: VT-mIPm-135-D Product: VT-mIPm-245-D

Summary

Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to execute commands with high privileges.

Vulnerabilities 2

  • Critical 10.0
    CVE-2023-40151

    Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function

    When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. W…

    Red Lion Controls ST-IPm-6350 VT-mIPm-245-D VT-IPm2m-113-D
  • Critical 10.0
    CVE-2023-42770

    Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel

    Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authenti…

    Red Lion Controls ST-IPm-6350 VT-mIPm-245-D VT-IPm2m-113-D

Revision history

  1. #1

    Initial Publication

References