redlion 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk cross-site scripting、vendor risk memory corruption、vendor risk csrf, and パス処理の欠陥 があり、vendor surface software deployment の利用場面で vendor impact session compromise、アプリケーションクラッシュ, and vendor impact memory corruption などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2023-5719 | The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. | [email protected] | 8.8 | 0.09% | 2023-11-06 | 2024-11-21 |
| CVE-2023-34412 | A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS). | [email protected] | 4.8 | 0.04% | 2023-08-17 | 2024-11-21 |
| CVE-2022-3090 | Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes. | [email protected] | 7.5 | 0.30% | 2022-11-17 | 2024-11-21 |
| CVE-2022-27179 | A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised. | [email protected] | 4.6 | 0.16% | 2022-04-20 | 2024-11-21 |
| CVE-2022-26516 | Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an unauthorized source or a file that was compromised between download and deployment. | [email protected] | 8.4 | 0.08% | 2022-04-20 | 2024-11-21 |
| CVE-2022-1039 | The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password. | [email protected] | 9.6 | 0.18% | 2022-04-20 | 2024-11-21 |
| CVE-2020-27283 | An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locations. | [email protected] | 5.3 | 0.18% | 2021-01-06 | 2026-06-02 |
| CVE-2020-27279 | A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a specially crafted packet that could reboot the device running Crimson 3.1 (Build versions prior to 3119.001). | [email protected] | 7.5 | 0.08% | 2021-01-06 | 2026-06-02 |
| CVE-2020-27285 | The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication. | [email protected] | 9.1 | 0.19% | 2021-01-06 | 2026-06-02 |
| CVE-2020-16210 | The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the context of an attacked user on the N-Tron 702-W / 702M12-W (all versions). | [email protected] | 9.0 | 1.52% | 2020-09-01 | 2024-11-21 |
| CVE-2020-16208 | The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authenticated user to click on a crafted link on the N-Tron 702-W / 702M12-W (all versions). | [email protected] | 8.8 | 0.26% | 2020-09-01 | 2024-11-21 |
| CVE-2020-16206 | The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to sensitive data on the N-Tron 702-W / 702M12-W (all versions). | [email protected] | 9.0 | 1.52% | 2020-09-01 | 2024-11-21 |
| CVE-2020-16204 | The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versions). | [email protected] | 9.8 | 3.24% | 2020-09-01 | 2024-11-21 |
| CVE-2019-10996 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that can reference memory after it has been freed. | [email protected] | 7.8 | 0.16% | 2019-09-23 | 2026-06-02 |
| CVE-2019-10990 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files. | [email protected] | 6.5 | 0.21% | 2019-09-23 | 2026-06-02 |
| CVE-2019-10984 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that causes the program to mishandle pointers. | [email protected] | 7.8 | 0.15% | 2019-09-23 | 2026-06-02 |
| CVE-2019-10978 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area. | [email protected] | 7.8 | 0.16% | 2019-09-23 | 2026-06-02 |
| CVE-2016-9335 | A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or | [email protected] | 10.0 | 0.24% | 2018-05-09 | 2024-11-21 |
| CVE-2017-14855 | Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42. | [email protected] | 8.6 | 0.62% | 2017-12-30 | 2026-05-13 |
| CVE-2017-16544 | In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. | [email protected] | 8.8 | 1.21% | 2017-11-20 | 2026-05-13 |