CRITICAL🇵🇱 Wersja polska

CVE-2016-9335

CVSS 10.0v3.0pub. 2018-05-09upd. 2024-11-21

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Redlion Sixnet Managed Industrial Switches

    HW
    Redlion
    all versions

  • Redlion Sixnet Managed Industrial Switches Firmware

    OS
    Redlion
    ≤ 5.0.196

  • Redlion Stride Managed Ethernet Switches

    HW
    Redlion
    all versions

  • Redlion Stride Managed Ethernet Switches Firmware

    OS
    Redlion
    ≤ 5.0.190
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-1039CRITICAL9.6PL ✓same vendor

Słabe hasła w Red Lion DA50N umożliwiają przejęcie urządzenia

CVE-2020-27285CRITICAL9.1PL ✓same vendor

Red Lion Crimson 3.1 — dostęp do bazy danych bez uwierzytelnienia

CVE-2020-16210CRITICAL9.0PL ✓same vendor

Reflected XSS umożliwiający RCE w Red Lion N-Tron 702-W / 702M12-W

CVE-2020-16206CRITICAL9.0PL ✓same vendor

Stored XSS umożliwiający RCE w Red Lion N-Tron 702-W / 702M12-W

CVE-2020-16204CRITICAL9.8PL ✓same vendor

Ukryty interfejs w Red Lion N-Tron 702-W umożliwia wykonanie komend jako root