Redlion develops industrial networking and control products, particularly its Crimson software platform and N-Tron industrial ethernet switches, that serve critical infrastructure and manufacturing environments where extended product lifecycles and integration complexity create durable security challenges. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes, reflecting the high-consequence nature of flaws in networked industrial control systems. The exposure recurs across Crimson and the N-Tron 702 switch line through weakness classes including cross-site scripting, hard-coded credentials, hard-coded cryptographic keys, and cross-site request forgery, patterns characteristic of industrial software that prioritizes availability and ease-of-deployment over defense-in-depth. Defenders managing these products should treat critical disclosures as urgent and prioritize isolation and access controls on industrial network segments; live severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Redlion over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-16204CRITICAL The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / | Sep 1, 2020 | 9.8 | 32 | NO | NO |
CVE-2017-16544HIGH In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitiz | Nov 20, 2017 | 8.8 | 31 | NO | NO |
CVE-2022-1039CRITICAL The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux a | Apr 20, 2022 | 9.8 | 29 | NO | NO |
CVE-2023-5719CRITICAL
The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to | Nov 6, 2023 | 9.8 | 28 | NO | NO |
CVE-2020-27285CRITICAL The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication. | Jan 6, 2021 | 9.1 | 28 | NO | NO |
CVE-2016-9335CRITICAL A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Swi | May 9, 2018 | 10.0 | 28 | NO | NO |
CVE-2020-16208HIGH The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authenticated user to clic | Sep 1, 2020 | 8.8 | 26 | NO | NO |
CVE-2017-14855HIGH Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demonstrated by version | Dec 30, 2017 | 8.6 | 26 | NO | NO |
CVE-2022-26516HIGH Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an | Apr 20, 2022 | 7.8 | 25 | NO | NO |
CVE-2019-10996HIGH Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafte | Sep 23, 2019 | 7.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Redlion.
Media articles that mention a CVE ID that affects a product developed by Redlion — matched by CVE ID, not by vendor name.