vulnwire
10.0crit

CVE-2016-9335

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Versio…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
10.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 75%
Public exploits
0
none known

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174.

Exploit prediction (EPSS)

1.54% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.010.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Red Lion Controls Sixnet-Managed Industrial Switches
  • AutomationDirect STRIDE-Managed Ethernet Switch models

Classification

Weakness
  • CWE-321 Use of Hard-coded Cryptographic Key
  • CWE-798 Use of Hard-coded Credentials

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.