Redlion
20 CVEs across 45 Redlion products. Browse Redlion vulnerabilities, severities, and proof-of-concept exploits.
Redlion products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5719 | High | 8.8 | 2023-11-06 | The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting secur… |
CVE-2023-34412 | Medium | 4.8 | 2023-08-17 | A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker… |
CVE-2022-3090 | High | 7.5 | 2022-11-17 | Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable… |
CVE-2022-27179 | Medium | 4.6 | 2022-04-20 | A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the… |
CVE-2022-26516 | High | 8.4 | 2022-04-20 | Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package… |
CVE-2022-1039 | Critical | 9.6 | 2022-04-20 | The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The wea… |
CVE-2020-27283 | Medium | 5.3 | 2021-01-06 | An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locations. |
CVE-2020-27279 | High | 7.5 | 2021-01-06 | A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a specially crafted packet that could reboot the d… |
CVE-2020-27285 | Critical | 9.1 | 2021-01-06 | The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication. |
CVE-2020-16210 | Critical | 9.0 | 2020-09-01 | The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the… |
CVE-2020-16208 | High | 8.8 | 2020-09-01 | The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authe… |
CVE-2020-16206 | Critical | 9.0 | 2020-09-01 | The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to sensitive d… |
CVE-2020-16204 | Critical | 9.8 | 2020-09-01 | The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device… |
CVE-2019-10996 | High | 7.8 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user ope… |
CVE-2019-10990 | Medium | 6.5 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and… |
CVE-2019-10984 | High | 7.8 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user ope… |
CVE-2019-10978 | High | 7.8 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user ope… |
CVE-2016-9335 | Critical | 10.0 | 2018-05-09 | A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride… |
CVE-2017-14855 | High | 8.6 | 2017-12-30 | Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as dem… |
CVE-2017-16544 | High | 8.8 | 2017-11-20 | In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a direct… |