Priority LOW 29
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the co…
Vulnerabilities
11 records
Priority LOW 37
Navigating to a certain URL on the switch’s web server causes the switch to reboot.
Priority LOW 36
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device.
Priority MEDIUM 42
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authenti…
Priority MEDIUM 41
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption.
TI-2026-70077 CVE-2026-39460
Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials
Priority MEDIUM 42
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file.
Priority MEDIUM 40
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
TI-2023-22865 CVE-2023-42770 · GHSA-vwrm-49fw-hjgj
Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel
Priority MEDIUM 51
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP.
TI-2023-21028 CVE-2023-40151 · GHSA-hxg4-c72j-73rf
Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function
Priority MEDIUM 51
When user authentication is not enabled the shell can execute commands with the highest privileges.
TI-2022-02851 CVE-2022-3090 · GHSA-vv26-mr89-rpfc
Path traversal in Red Lion Controls Crimson 3.0
Priority MEDIUM 40
Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal.
TI-2016-07615 CVE-2016-9335 · GHSA-v3f3-rpcm-8jhw
Hard-coded credentials in Red Lion Controls Sixnet-Managed Industrial Switches
Priority MEDIUM 46
A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190.