title: Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel
description:
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge.
problem types: CWE-288 Authentication Bypass Using An Alternative Path Or Channel
affected:
{
defaultStatus: unaffected
product: ST-IPm-8460
vendor: Red Lion Controls
versions:
status: affected, version: 6.0.202
}
{
defaultStatus: unaffected
product: ST-IPm-6350
vendor: Red Lion Controls
versions:
status: affected, version: 4.9.114
}
{
defaultStatus: unaffected
product: VT-mIPm-135-D
vendor: Red Lion Controls
versions:
status: affected, version: 4.9.114
}
{
defaultStatus: unaffected
product: VT-mIPm-245-D
vendor: Red Lion Controls
versions:
status: affected, version: 4.9.114
}
{
defaultStatus: unaffected
product: VT-IPm2m-213-D
vendor: Red Lion Controls
versions:
status: affected, version: 4.9.114
}
{
defaultStatus: unaffected
product: VT-IPm2m-113-D
vendor: Red Lion Controls
versions:
status: affected, version: 4.9.114
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Red Lion recommends users apply the  latest patches https://support.redlion.net/hc/en-us/articles/19338927539981-SixTRAK-and-VersaTRAK-Security-Patch-RLCSIM-2023-05  to their products.
Red Lion recommends users apply additional mitigations to help reduce the risk:
*  Enable user authentication, see  Red Lion instructions https://support.redlion.net/hc/en-us/articles/18190385510797-ACCESS-RTU-and-IO-How-to-install-a-patch-or-package-to-the-RTU .
Blocking all or most Sixnet UDR messages over TCP/IP will eliminate authentication bypass. Sixnet UDR messages over TCP/IP will be ignored.
To block all Sixnet UDR messages over TCP/IP install Patch1_tcp_udr_all_blocked.tar.gz.
*  ST-IPm-8460 – Install 8313_patch1_tcp_udr_all_blocked.tar.gz
*  ST-IPm-6350/VT-mIPm-245-D/VT-mIPm-135-D/VT-IPm2m-213-D/VT-IPm2m-113-D – Install 855_patch1_tcp_udr_all_blocked.tar.gz
To block all Sixnet UDR messages except I/O commands over TCP/IP and UDP/IP install Patch2_io_open.tar.gz.
*  ST-IPm-8460 – Install 8313_patch2_io_open.tar.gz
*  ST-IPm-6350/VT-mIPm-245-D/VT-mIPm-135-D/VT-IPm2m-213-D/VT-IPm2m-113-D – Install 855_patch2_io_open.tar.gz
To Block all Sixnet UDR messages over TCP/IP:
*  Enable iptables rules to block TCP/IP traffic.
*  In the Sixnet I/O Tool Kit go to Configuration>Configuration Station/Module>"Ports" tab>Security.
*  Select the "Load the this file with each station load" radio button to load a custom rc.firewall configuration file. The rules below will allow all other traffic except Sixnet UDR over TCP/IP. Please Note: Two rules that are added in by default were removed because they will block all traffic going into the interface.
Remove these rules from the default rc.firewall file:
*  iptables -P INPUT DROP (Drops everything coming in)
*  iptables -P FORWARD DROP (Drops everything in FORWARD chain)
Add one DROP rule which will drop all TCP/IP packet coming on UDR port 1594 by typing the following commands:
*  insmodip_tables (Initialization)
*  insmodiptable_filter (Initialization)
*  insmodip_conntrack (Initialization)
*  insmodiptable_nat (Initialization)
*  iptables -F INPUT (Flushes INPUT chain)
*  iptables -F OUTPUT (Flushes OUTPUT chain)
*  iptables -F FORWARD (Flushes FORWARD chain)
*  iptables -Z (Zero counters)
*  iptables -P OUTPUT ACCEPT (Drops everything coming in, everything in FORWARD chain, and accepts everything going out)
*  iptables -A INPUT -p tcp --dport 1594 -j DROP (Allows local traffic and blocks all TCP traffic coming from 1594)
For installation instructions see  Red Lion's support page https://support.redlion.net/hc/en-us/articles/18190385510797-ACCESS-RTU-and-IO-How-to-install-a-patch-or-package-to-the-RTU .
For more information, please refer to  Red Lion’s security bulletin https://support.redlion.net/hc/en-us/articles/19339209248269-RLCSIM-2023-05-Authentication-Bypass-and-Remote-Code-Execution .