Red Lion Controls Crimson
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-10996US | high7.8 | — | ||
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafte… | ||||
| CVE-2019-10990US | medium6.5OT elevated | — | ||
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may a… | ||||
| CVE-2019-10984US | high7.8 | — | ||
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafte… | ||||
| CVE-2019-10978US | high7.8 | — | ||
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafte… | ||||
references
External citations — patches, advisories, analysis.
remediations (8)
- MitigationCrimson
For more information, Red Lion Controls has released a security bulletin that can be found at the following link:
https://support.redlion.net/hc/en-us/articles/360033077531 - MitigationCrimson
For more information, Red Lion Controls has released a security bulletin that can be found at the following link:
https://support.redlion.net/hc/en-us/articles/360033077531 - MitigationCrimson
For more information, Red Lion Controls has released a security bulletin that can be found at the following link:
https://support.redlion.net/hc/en-us/articles/360033077531 - MitigationCrimson
The use of a hardcoded key vulnerability (CVE-2019-10990) can be mitigated in two ways: In a later release, targeted for September 2019, Red Lion Controls will modify the existing database protection scheme to include an option for a second file access password designed to encrypt the file.
- FixedCrimson
Red Lion Controls recommends users migrate to Crimson 3.1 release 3112.00 or later where the model choice allows. Updated software can be found at the following link:
https://www.redlion.net/red-lion-software/crimson - FixedCrimson
Red Lion Controls recommends users migrate to Crimson 3.1 release 3112.00 or later where the model choice allows. Updated software can be found at the following link:
https://www.redlion.net/red-lion-software/crimson - FixedCrimson
Red Lion Controls recommends users migrate to Crimson 3.1 release 3112.00 or later where the model choice allows. Updated software can be found at the following link:
https://www.redlion.net/red-lion-software/crimson - FixedCrimson
The use of a hardcoded key vulnerability (CVE-2019-10990) can be mitigated in two ways: The user manual for Crimson 3.1 release 3112.00 now includes a paragraph describing the intended use of the database protection mechanism, noting the software is not designed to provide a cryptographically secure method of database protection.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan