Researchers have discovered several vulnerabilities, including ones that have been classified as serious, in a human-machine interface (HMI) programming software made by U.S.-based Red Lion.
Industrial automation and networking solutions firm Red Lion is a subsidiary of U.K.-based Spectris, a provider of highly-specialized measuring instruments and controls. According to the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), Red Lion’s products are used worldwide, mainly in the critical manufacturing sector.
Trend Micro researchers Michael DePlante, Anthony Fuller and Todd Manning discovered that Red Lion’s Crimson programming software, specifically versions 3.0 and prior and 3.1 prior to the 3112.00 release, are affected by four types of vulnerabilities, with multiple variations for each issue.
CISA published an advisory for these vulnerabilities last week to notify organizations using the impacted Red Lion product.
Trend Micro’s Zero Day Initiative (ZDI), through which the researchers reported their findings to the vendor, has also published advisories for each of the vulnerabilities. The security holes are tracked as CVE-2019-10996, CVE-2019-10978, CVE-2019-10984 and CVE-2019-10990.
The most serious of them allows an attacker to remotely execute arbitrary code in the context of the current process by convincing the targeted user to open a specially crafted CD3 file.
Another flaw is related to the existence of hardcoded passwords that can be used to access some information. Red Lion has clarified in an advisory that the issue is related to the passwords for password-protected databases being stored in the database. The company has released new documentation to clarify that these passwords are meant to help manage user access, not to keep databases cryptographically secure. Future versions of Crimson 3.1 will have a second password that will be used to encrypt a database.
“It is important to note that the hardcoded password is only evaluated in the Windows client (Crimson) to control access levels for viewing and editing a configuration (database) file, independently of the target device. The target device itself does not use the hardcoded password and at no point is the hardcoded password used for the operation of the device’s runtime activity,” Red Lion said in its advisory.
The other two vulnerabilities found by the researchers are memory corruption issues that can be used to obtain sensitive information by getting the targeted user to open a specially crafted CD31 file. ZDI noted in its advisories that these flaws can be used in combination with other weaknesses to execute arbitrary code in the context of the current process.
Red Lion has released Crimson 3.1 version 3112.00 to patch the vulnerabilities, but the company has informed customers that it does not plan on releasing an update for Crimson 3.0.
Related: ABB Patches Many Vulnerabilities in HMI Products
Related: Code Execution Flaws Found in EZAutomation PLC, HMI Software
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
- Thousands Access Fake DDoS-for-Hire Websites Set Up by UK Police
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
Latest News
- Microsoft Puts ChatGPT to Work on Automating Cybersecurity
- Video: How to Build Resilience Against Emerging Cyber Threats
- Nigerian BEC Scammer Sentenced to Prison in US
- China’s Nuclear Energy Sector Targeted in Cyberespionage Campaign
- SecurityScorecard Guarantees Accuracy of Its Security Ratings
- ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
- 14 Million Records Stolen in Data Breach at Latitude Financial Services
- Webinar Today: Understanding Hidden Third-Party Identity Access Risks
