Two CVSS 10.0 Bugs in Red Lion RTUs Could Hand Hackers Full Industrial Control

Cybersecurity researchers have disclosed two CVSS 10.0 vulnerabilities in Red Lion Sixnet RTUs, CVE-2023-40151 and CVE-2023-42770, which could allow an unauthenticated attacker to gain remote code execution with root privileges. The flaws affect Red Lion’s SixTRAK and VersaTRAK RTUs, and could enable an attacker to chain the authentication bypass with remote command execution.

One flaw (CVE-2023-42770) arises from the Sixnet RTU software listening on port 1594 in UDP and TCP, prompting for authentication over UDP but accepting TCP messages without any authentication challenge. The other (CVE-2023-40151) leverages the Sixnet Universal Driver’s built-in support for Linux shell commands to run arbitrary code as root. Red Lion has issued an advisory and urges applying patches and enabling user authentication, while also recommending blocking TCP access to affected RTUs.

According to an alert issued by CISA in November 2023, the vulnerabilities impact a range of Sixnet and related devices, underscoring the serious risk to industrial control systems across energy, water, and other sectors.