Red Lion Controls

Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP.

When user authentication is not enabled the shell can execute commands with the highest privileges.

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190.

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file.

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authenti…

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption.

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.

Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal.

Navigating to a certain URL on the switch’s web server causes the switch to reboot.

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device.

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the co…