Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel
Priority MEDIUM 51CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.
Summary
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00879 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Lion Controls | ST-IPm-8460 | 6.0.202 | — | No fix listed | CNA |
| Red Lion Controls | ST-IPm-6350 | 4.9.114 | — | No fix listed | CNA |
| Red Lion Controls | VT-mIPm-135-D | 4.9.114 | — | No fix listed | CNA |
| Red Lion Controls | VT-mIPm-245-D | 4.9.114 | — | No fix listed | CNA |
| Red Lion Controls | VT-IPm2m-213-D | 4.9.114 | — | No fix listed | CNA |
| Red Lion Controls | VT-IPm2m-113-D | 4.9.114 | — | No fix listed | CNA |
- ST-IPm-8460 VendorRed Lion Controls Affected 6.0.202 Fixed in — No fix listed CNA
- ST-IPm-6350 VendorRed Lion Controls Affected 4.9.114 Fixed in — No fix listed CNA
- VT-mIPm-135-D VendorRed Lion Controls Affected 4.9.114 Fixed in — No fix listed CNA
- VT-mIPm-245-D VendorRed Lion Controls Affected 4.9.114 Fixed in — No fix listed CNA
- VT-IPm2m-213-D VendorRed Lion Controls Affected 4.9.114 Fixed in — No fix listed CNA
- VT-IPm2m-113-D VendorRed Lion Controls Affected 4.9.114 Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redlioncontrols:st-ipm-6350_firmware:4.9.114:*:*:*:*:*:*:* | 4.9.114 | Vulnerable | Red Lion Controls |
| cpe:2.3:h:redlioncontrols:st-ipm-6350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Lion Controls |
| cpe:2.3:o:redlioncontrols:st-ipm-8460_firmware:6.0.202:*:*:*:*:*:*:* | 6.0.202 | Vulnerable | Red Lion Controls |
| cpe:2.3:h:redlioncontrols:st-ipm-8460:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Lion Controls |
| cpe:2.3:o:redlioncontrols:vt-mipm-135-d_firmware:4.9.114:*:*:*:*:*:*:* | 4.9.114 | Vulnerable | Red Lion Controls |
| cpe:2.3:h:redlioncontrols:vt-mipm-135-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Lion Controls |
| cpe:2.3:o:redlioncontrols:vt-mipm-245-d_firmware:4.9.114:*:*:*:*:*:*:* | 4.9.114 | Vulnerable | Red Lion Controls |
| cpe:2.3:h:redlioncontrols:vt-mipm-245-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Lion Controls |
| cpe:2.3:o:redlioncontrols:vt-ipm2m-213-d_firmware:4.9.114:*:*:*:*:*:*:* | 4.9.114 | Vulnerable | Red Lion Controls |
| cpe:2.3:h:redlioncontrols:vt-ipm2m-213-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Lion Controls |
- cpe:2.3:o:redlioncontrols:st-ipm-6350_firmware:4.9.114:*:*:*:*:*:*:* Versions 4.9.114 Vulnerable ·Red Lion Controls
- cpe:2.3:h:redlioncontrols:st-ipm-6350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion Controls
- cpe:2.3:o:redlioncontrols:st-ipm-8460_firmware:6.0.202:*:*:*:*:*:*:* Versions 6.0.202 Vulnerable ·Red Lion Controls
- cpe:2.3:h:redlioncontrols:st-ipm-8460:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion Controls
- cpe:2.3:o:redlioncontrols:vt-mipm-135-d_firmware:4.9.114:*:*:*:*:*:*:* Versions 4.9.114 Vulnerable ·Red Lion Controls
- cpe:2.3:h:redlioncontrols:vt-mipm-135-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion Controls
- cpe:2.3:o:redlioncontrols:vt-mipm-245-d_firmware:4.9.114:*:*:*:*:*:*:* Versions 4.9.114 Vulnerable ·Red Lion Controls
- cpe:2.3:h:redlioncontrols:vt-mipm-245-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion Controls
- cpe:2.3:o:redlioncontrols:vt-ipm2m-213-d_firmware:4.9.114:*:*:*:*:*:*:* Versions 4.9.114 Vulnerable ·Red Lion Controls
- cpe:2.3:h:redlioncontrols:vt-ipm2m-213-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion Controls
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redlioncontrols:vt-ipm2m-113-d_firmware:4.9.114:*:*:*:*:*:*:* | 4.9.114 | Vulnerable | Red Lion Controls |
| cpe:2.3:h:redlioncontrols:vt-ipm2m-113-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Lion Controls |
- cpe:2.3:o:redlioncontrols:vt-ipm2m-113-d_firmware:4.9.114:*:*:*:*:*:*:* Versions 4.9.114 Vulnerable ·Red Lion Controls
- cpe:2.3:h:redlioncontrols:vt-ipm2m-113-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Lion Controls
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-42770
- 2026-10-03 Alias added: GHSA-vwrm-49fw-hjgj
References
More Red Lion Controls St-ipm-6350 Firmware vulnerabilities
- TI-2023-21028 Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function CVSS 3.1CRITICAL 10.0
Sources
- CVE-2023-42770 · CVE Program
- CVE-2023-42770 · NVD
- FIRST EPSS
- GHSA-vwrm-49fw-hjgj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences