by Kastro
Paper/Archive/CVE-2023-40151

CVE-2023-40151

Red Lion Controls ST-IPm-8460 — Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function

EPSS 1%CVSS 10.0
critical.is priorityof 100
43
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 66.9.669 × 2013.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authentication challenge.

Affected

ProductAffectedFixed inSource
ST-IPm-84606.0.202–CNA
ST-IPm-63504.9.114–CNA
VT-mIPm-135-D4.9.114–CNA
VT-mIPm-245-D4.9.114–CNA
VT-IPm2m-213-D4.9.114–CNA
VT-IPm2m-113-D4.9.114–CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-320-01refsupport.redlion.net/hc/en-us/articles/19339209248269-RLCSIM-2023-05-Authentication-Bypass-and-Remote-Code-Execution