{"containers": {"cna": {"affected": [{"product": "Sixnet-Managed Industrial Switches", "vendor": "Red Lion Controls", "versions": [{"status": "affected", "version": "firmware Version 5.0.196 and prior"}]}, {"product": "STRIDE-Managed Ethernet Switch models", "vendor": "AutomationDirect", "versions": [{"status": "affected", "version": "firmware Version 5.0.190 and prior."}]}], "datePublic": "2017-02-23T00:00:00", "descriptions": [{"lang": "en", "value": "A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "Use of hard-coded cryptographic key CWE-321", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-05-09T12:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2017-02-23T00:00:00", "ID": "CVE-2016-9335", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Sixnet-Managed Industrial Switches", "version": {"version_data": [{"version_value": "firmware Version 5.0.196 and prior"}]}}]}, "vendor_name": "Red Lion Controls"}, {"product": {"product_data": [{"product_name": "STRIDE-Managed Ethernet Switch models", "version": {"version_data": [{"version_value": "firmware Version 5.0.190 and prior."}]}}]}, "vendor_name": "AutomationDirect"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Use of hard-coded cryptographic key CWE-321"}]}]}, "references": {"reference_data": [{"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02"}]}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2016-9335", "datePublished": "2017-02-23T00:00:00", "dateReserved": "2016-11-16T00:00:00", "dateUpdated": "2018-05-09T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redlion:sixnet-managed_industrial_switches_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "03F5E9D5-C1A6-4BCC-BADC-26A4B8F69878", "versionEndIncluding": "5.0.196", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:redlion:sixnet-managed_industrial_switches:-:*:*:*:*:*:*:*", "matchCriteriaId": "ACD086CC-785D-4926-B0DC-4CB158BA4B89", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redlion:stride-managed_ethernet_switches_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B6D8043-8582-40C3-A28B-6C98EA632820", "versionEndIncluding": "5.0.190", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:redlion:stride-managed_ethernet_switches:-:*:*:*:*:*:*:*", "matchCriteriaId": "9D2E9860-EA9B-4A41-B555-B12D3F33D199", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de clave criptogr\u00e1fica embebida en Red Lion Controls Sixnet-Managed Industrial Switches con firmware en versi\u00f3n 5.0.196 y Stride-Managed Ethernet Switches con firmware en versi\u00f3n 5.0.190. Las versiones vulnerables de los switches Stride-Managed Ethernet y Sixnet-Managed Industrial emplean claves SSL/SSH HTTP embebidas para lograr una comunicaci\u00f3n segura. Debido a que las claves no pueden ser regeneradas por los usuarios, todos los productos emplean la misma clave. El atacante podr\u00eda interrumpir la comunicaci\u00f3n o comprometer el sistema. Puntuaci\u00f3n base de CVSS v3: 10, cadena de vector CVSS: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recomienda actualizar a la versi\u00f3n de firmware SLX 5.3.174."}], "id": "CVE-2016-9335", "lastModified": "2019-10-09T23:20:24.460", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-05-09T13:29:00.247", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-321"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}