CVE-2023-42770 Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel
Attackers can bypass authentication on Red Lion RTUs by sending messages over TCP instead of UDP, allowing unauthorized access to industrial control systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-42770?
CVE-2023-42770 is a critical authentication bypass vulnerability in Red Lion Controls ST-IPm-6350, published on 21 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge.
Which versions are affected by CVE-2023-42770?
It affects 6 products.
Products include Redlioncontrols St-Ipm-6350 Firmware, Redlioncontrols St-Ipm-8460 Firmware, Redlioncontrols Vt-Ipm2m-113-D Firmware, Redlioncontrols Vt-Ipm2m-213-D Firmware, Redlioncontrols Vt-Mipm-135-D Firmware, Redlioncontrols Vt-Mipm-245-D Firmware.
How do I fix CVE-2023-42770?
No fix has been published for CVE-2023-42770 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-42770 being exploited?
There is no known exploitation of CVE-2023-42770 in the wild and no public exploit code.
Other vulnerabilities in Red Lion Controls ST-IPm-6350
Sources
Also known as GHSA-vwrm-49fw-hjgj.