Description
When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authentication challenge.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Lion Controls | ST-IPm-8460 | 6.0.202 | — |
| Red Lion Controls | ST-IPm-6350 | 4.9.114 | — |
| Red Lion Controls | VT-mIPm-135-D | 4.9.114 | — |
| Red Lion Controls | VT-mIPm-245-D | 4.9.114 | — |
| Red Lion Controls | VT-IPm2m-213-D | 4.9.114 | — |
| Red Lion Controls | VT-IPm2m-113-D | 4.9.114 | — |
Advisories 1
- ICSA-23-320-01 Red Lion Sixnet RTUs CISA ICS & IT advisories · Nov 16, 2023