Authentication flaw

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...

CVE-2023-42770 Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel

Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...

CVE-2023-42770 Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel

Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge...

CVE-2023-42770

CVE-2023-42770 affects Red Lion SixTRAK and VersaTRAK RTUs. An authentication bypass occurs because Sixnet UDR messages on UDP/TCP are treated differently: UDP prompts for authentication, while TCP accepts without challenge. This enables an attacker to bypass authentication and, in conjunction wi...

CVE-2023-40151

CVE-2023-40151 affects Red Lion SixTRAK and VersaTRAK RTUs. Two flaws enable: (1) CVE-2023-42770 authentication bypass where UDP requires auth but TCP messages are accepted without challenge; (2) CVE-2023-40151 remote code execution via Sixnet UDR shell command execution, allowing root privileges...

CVE-2023-40151 Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...

CVE-2023-40151 Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...

Red Lion Controls SixTRAK and VersaTRAK Access Control Error Vulnerability

Red Lion Controls SixTRAK and Red Lion Controls VersaTRAK are the ultimate process controllers with open LINUX software capabilities from Red Lion Controls, Inc. A security vulnerability exists in the Red Lion Controls SixTRAK and VersaTRAK Series RTUs that originated to allow an attacker to bypa...

Red Lion Controls SixTRAK and VersaTRAK Security Vulnerabilities

Red Lion Controls SixTRAK and Red Lion Controls VersaTRAK are the ultimate process controllers with open LINUX software capabilities from Red Lion Controls, Inc. A security vulnerability exists in the Red Lion Controls SixTRAK and VersaTRAK Series RTUs that originated from allowing an...

Red Lion Sixnet RTUs

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION : Exploitable remotely/low attack complexity Vendor : Red Lion Equipment : Sixnet RTU Vulnerabilities : Authentication Bypass using an Alternative Path or Channel, Exposed Dangerous Method or Function 2. RISK EVALUATION Successful exploitation...

PT-2023-7324 · Red Lion · Red Lion Versatrak +1

Name of the Vulnerable Software and Affected Versions: Red Lion SixTRAK and VersaTRAK Series RTUs affected versions not specified Description: The issue is related to the authentication function in Red Lion SixTRAK and VersaTRAK Series RTUs. When authenticated users are enabled, any Sixnet UDR...

CVE-2023-46092

Cross-Site Request Forgery CSRF vulnerability in LionScripts.Com Webmaster Tools allows Stored XSS.This issue affects Webmaster Tools: from n/a through 2.0...

CVE-2023-5719 Red Lion Crimson Improper Neutralization of Null Byte or NUL Character

The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent % character, invalid values will be included, potentially truncating...

Red Lion Controls Crimson Security Vulnerability

Red Lion Controls Crimson is a suite of HMI programming software from Red Lion Controls. A security vulnerability exists in the Red Lion Controls Crimson 3.2 Windows-based configuration tool that could allow an attacker with administrative access to define a new password for a user and download a...

Red Lion Crimson

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Red Lion Equipment : FlexEdge Gateway, DA50A, DA70A running Crimson Vulnerability : Improper Neutralization of Null Byte or NUL Character 2. RISK EVALUATION Successful exploitation of this...

CVE-2023-46093

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in LionScripts.Com Webmaster Tools plugin = 2.0 versions...

CVE-2023-4834

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he shoul...

CVE-2023-4834

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he shoul...

CVE-2023-4834

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he shoul...

CVE-2023-4834

Summary: CVE-2023-4834 affects Red Lion Europe mbCONNECT24, mymbCONNECT24, and Helmholz myREX24 / myREX24.virtual up to version 2.14.2. The root cause is an improperly implemented access validation, enabling an authenticated, low-privileged attacker to read limited, non-critical device informatio...