CVE-2023-40151 (published 2023-11-21T00:11:10.081Z)



When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authentication challenge.




Affected products: Vendor: Red Lion Controls
Product: ST-IPm-8460
Versions: 6.0.202