CVE-2023-42770

When the user authentication option (UDR-A) is enabled on the device, Sixnet UDR protocol messages transmitted via UDP/IP are correctly verified and require authentication. However, the same message sent via TCP/IP is accepted by the RTU without any authentication challenge. An attacker can therefore bypass the authentication mechanism by choosing only TCP/IP transport instead of UDP/IP. This results in full unauthorized access to the device from the network level.

An unauthorized attacker can remotely, without any credentials, gain full control over the RTU device, including modifying configuration, affecting industrial processes, and potentially executing remote code (RCE) on the device.

Patches available from the manufacturer should be applied according to references. Detailed information is available in the Red Lion security bulletin RLCSIM-2023-05 and in the CISA ICS Advisory ICSA-23-320-01 guide. Additionally, it is recommended to segment the industrial network and restrict access to TCP ports of RTU devices only to trusted hosts.

Red Lion SixTRAK and VersaTRAK Series RTU: ST-IPM-6350 Firmware, ST-IPM-6350, ST-IPM-8460 Firmware, ST-IPM-8460, VT-MIPM-135-D Firmware — with user authentication option (UDR-A) enabled. Exact firmware versions indicated in the manufacturer's references.