CVE Feed

    Dashboard / CVE / CVE-2023-5719

    CVE-2023-5719

    The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.

    Published:Nov 6, 2023
    Last Modified:Jan 16, 2025
    EPS:Nov 6, 2023
    EPSS Score:0.0009
    CVSS Score:8.8

    Affected Products

    Vendor
    Redlion
    Product
    Crimson
    Vendor
    Redlion
    Product
    Da50a
    Vendor
    Redlion
    Product
    Da70a

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-52 Embedding NULL Bytes
    CAPEC-53 Postfix, Null Terminate, and Backslash

    Related CVEs

    CVE-2022-3090 (CVSS 7.5) — Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson…
    CVE-2020-27283 (CVSS 5.3) — An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that coul…
    CVE-2020-27279 (CVSS 7.5) — A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a…
    CVE-2020-27285 (CVSS 9.1) — The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read a…
    CVE-2019-10984 (CVSS 7.8) — Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vuln…
    CVE-2019-10978 (CVSS 7.8) — Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vuln…
    CVE-2019-10996 (CVSS 7.8) — Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vuln…
    CVE-2019-10990 (CVSS 6.5) — Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded p…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High