Read the docs
TI-2023-05262 Aliases CVE-2023-5719GHSA-7346-p858-4r4c

Red Lion Crimson Improper Neutralization of Null Byte or NUL Character

Priority MEDIUM 44CWE-158Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00618 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red LionCrimsonup to v3.2.0053.18—No fix listedCNA
  • Crimson VendorRed Lion Affected up to v3.2.0053.18 Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:redlion:crimson:*:*:*:*:*:*:*:*before 3.2VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0008.0:*:*:*:*:*:*3.2 build_3.2.0008.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0014.0:*:*:*:*:*:*3.2 build_3.2.0014.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0015.0:*:*:*:*:*:*3.2 build_3.2.0015.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0016.0:*:*:*:*:*:*3.2 build_3.2.0016.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0020.0:*:*:*:*:*:*3.2 build_3.2.0020.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0021.0:*:*:*:*:*:*3.2 build_3.2.0021.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0025.0:*:*:*:*:*:*3.2 build_3.2.0025.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0026.0:*:*:*:*:*:*3.2 build_3.2.0026.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0030.0:*:*:*:*:*:*3.2 build_3.2.0030.0VulnerableRed Lion
  • cpe:2.3:a:redlion:crimson:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0008.0:*:*:*:*:*:* Versions 3.2 build_3.2.0008.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0014.0:*:*:*:*:*:* Versions 3.2 build_3.2.0014.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0015.0:*:*:*:*:*:* Versions 3.2 build_3.2.0015.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0016.0:*:*:*:*:*:* Versions 3.2 build_3.2.0016.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0020.0:*:*:*:*:*:* Versions 3.2 build_3.2.0020.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0021.0:*:*:*:*:*:* Versions 3.2 build_3.2.0021.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0025.0:*:*:*:*:*:* Versions 3.2 build_3.2.0025.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0026.0:*:*:*:*:*:* Versions 3.2 build_3.2.0026.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0030.0:*:*:*:*:*:* Versions 3.2 build_3.2.0030.0 Vulnerable ·Red Lion
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0031.0:*:*:*:*:*:*3.2 build_3.2.0031.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0035.0:*:*:*:*:*:*3.2 build_3.2.0035.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0036.0:*:*:*:*:*:*3.2 build_3.2.0036.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0040.0:*:*:*:*:*:*3.2 build_3.2.0040.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0041.0:*:*:*:*:*:*3.2 build_3.2.0041.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0044.0:*:*:*:*:*:*3.2 build_3.2.0044.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0047.0:*:*:*:*:*:*3.2 build_3.2.0047.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0050.0:*:*:*:*:*:*3.2 build_3.2.0050.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0051.0:*:*:*:*:*:*3.2 build_3.2.0051.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.0:*:*:*:*:*:*3.2 build_3.2.0053.0VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.1:*:*:*:*:*:*3.2 build_3.2.0053.1VulnerableRed Lion
cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.18:*:*:*:*:*:*3.2 build_3.2.0053.18VulnerableRed Lion
cpe:2.3:h:redlion:da50a:-:*:*:*:*:*:*:*not specified by NVDRunning onRed Lion
cpe:2.3:h:redlion:da70a:-:*:*:*:*:*:*:*not specified by NVDRunning onRed Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0031.0:*:*:*:*:*:* Versions 3.2 build_3.2.0031.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0035.0:*:*:*:*:*:* Versions 3.2 build_3.2.0035.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0036.0:*:*:*:*:*:* Versions 3.2 build_3.2.0036.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0040.0:*:*:*:*:*:* Versions 3.2 build_3.2.0040.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0041.0:*:*:*:*:*:* Versions 3.2 build_3.2.0041.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0044.0:*:*:*:*:*:* Versions 3.2 build_3.2.0044.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0047.0:*:*:*:*:*:* Versions 3.2 build_3.2.0047.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0050.0:*:*:*:*:*:* Versions 3.2 build_3.2.0050.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0051.0:*:*:*:*:*:* Versions 3.2 build_3.2.0051.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.0:*:*:*:*:*:* Versions 3.2 build_3.2.0053.0 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.1:*:*:*:*:*:* Versions 3.2 build_3.2.0053.1 Vulnerable ·Red Lion
  • cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.18:*:*:*:*:*:* Versions 3.2 build_3.2.0053.18 Vulnerable ·Red Lion
  • cpe:2.3:h:redlion:da50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion
  • cpe:2.3:h:redlion:da70a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5719
  2. 2026-10-03 Alias added: GHSA-7346-p858-4r4c

References

Advisory 2

  • TI-2020-16609 Missing authentication in Crimson 3.1 CVSS 3.1CRITICAL 9.1
  • TI-2020-16603 NULL pointer dereference in Crimson 3.1 CVSS 3.1HIGH 7.5
  • TI-2022-02851 Path traversal in Red Lion Controls Crimson 3.0 CVSS 3.1HIGH 7.5
  • TI-2019-08214 Use after free in Red Lion Controls Crimson CVSS 3.1HIGH 7.8
  • TI-2019-08203 Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release… CVSS 3.1HIGH 7.8
  • TI-2019-08197 Memory corruption in Red Lion Controls Crimson CVSS 3.1HIGH 7.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences