CVE-2016-9335

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174.

CVSS v3 10.0 CRITICAL
CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:redlion:sixnet-managed_industrial_switches_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:redlion:sixnet-managed_industrial_switches:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:redlion:stride-managed_ethernet_switches_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:redlion:stride-managed_ethernet_switches:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-05-09 13:29

Updated : 2023-12-10 12:30

NVD link : CVE-2016-9335

Mitre link : CVE-2016-9335

CVE.ORG link : CVE-2016-9335

JSON object : View

Products Affected

redlion

sixnet-managed_industrial_switches
stride-managed_ethernet_switches_firmware
sixnet-managed_industrial_switches_firmware
stride-managed_ethernet_switches

CWE

CWE-798

Use of Hard-coded Credentials

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2016-9335", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2018-05-09T13:29:00.247", "references": [{"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de clave criptogr\u00e1fica embebida en Red Lion Controls Sixnet-Managed Industrial Switches con firmware en versi\u00f3n 5.0.196 y Stride-Managed Ethernet Switches con firmware en versi\u00f3n 5.0.190. Las versiones vulnerables de los switches Stride-Managed Ethernet y Sixnet-Managed Industrial emplean claves SSL/SSH HTTP embebidas para lograr una comunicaci\u00f3n segura. Debido a que las claves no pueden ser regeneradas por los usuarios, todos los productos emplean la misma clave. El atacante podr\u00eda interrumpir la comunicaci\u00f3n o comprometer el sistema. Puntuaci\u00f3n base de CVSS v3: 10, cadena de vector CVSS: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recomienda actualizar a la versi\u00f3n de firmware SLX 5.3.174."}], "lastModified": "2019-10-09T23:20:24.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redlion:sixnet-managed_industrial_switches_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03F5E9D5-C1A6-4BCC-BADC-26A4B8F69878", "versionEndIncluding": "5.0.196"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:redlion:sixnet-managed_industrial_switches:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ACD086CC-785D-4926-B0DC-4CB158BA4B89"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redlion:stride-managed_ethernet_switches_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B6D8043-8582-40C3-A28B-6C98EA632820", "versionEndIncluding": "5.0.190"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:redlion:stride-managed_ethernet_switches:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9D2E9860-EA9B-4A41-B555-B12D3F33D199"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}