CVE-2022-1039

ICSA-22-104-03 Red Lion DA50N

Description

The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password.

Remediation

Workaround:

  • Red Lion notes the DA50N series product is at end-of-life and does not intend to release a software update to address these vulnerabilities. Users are encouraged to apply workarounds and mitigations or upgrade their device to DA50A and DA70A. Red Lion has provided the following workarounds to help mitigate the risk of these vulnerabilities: Do not install image files that are obtained from sources other than the official Red Lion website. When downloading images from Red Lion’s website, ensure the validity of the server’s TLS certificate. If package files or images are to be stored before deployment, ensure they are stored in a secure manner. Minimize the risk of unauthorized installation via SD card by limiting physical access to the device. Ensure the default UI password is changed to one meeting standard security practices. Change the admin, rlcuser and techsup account passwords from their default values. Disable the SSH service and keep the telnet service disabled if they are not required. Do not re‐use the same password for securing multiple resources. Limit access to configuration files that contain valuable credentials. Ensure the use of secure credentials when configuring optional services. Enable only the minimum set of optional services required for the application.

Category

9.6
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.21%
Third-Party Advisory cisa.gov
Affected: Red Lion DA50N
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-03 third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2022-1039?
CVE-2022-1039 has been scored as a critical severity vulnerability.
How to fix CVE-2022-1039?
As a workaround for remediating CVE-2022-1039: Red Lion notes the DA50N series product is at end-of-life and does not intend to release a software update to address these vulnerabilities. Users are encouraged to apply workarounds and mitigations or upgrade their device to DA50A and DA70A. Red Lion has provided the following workarounds to help mitigate the risk of these vulnerabilities: Do not install image files that are obtained from sources other than the official Red Lion website. When downloading images from Red Lion’s website, ensure the validity of the server’s TLS certificate. If package files or images are to be stored before deployment, ensure they are stored in a secure manner. Minimize the risk of unauthorized installation via SD card by limiting physical access to the device. Ensure the default UI password is changed to one meeting standard security practices. Change the admin, rlcuser and techsup account passwords from their default values. Disable the SSH service and keep the telnet service disabled if they are not required. Do not re‐use the same password for securing multiple resources. Limit access to configuration files that contain valuable credentials. Ensure the use of secure credentials when configuring optional services. Enable only the minimum set of optional services required for the application.
Is CVE-2022-1039 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-1039 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-1039?
CVE-2022-1039 affects Red Lion DA50N.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.