Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Red Lion Sixnet and Stride switches share unchangeable encryption key

CVE-2016-9335 · published 8 years ago
Summary

The firmware on Red Lion Sixnet‑Managed Industrial Switches (v5.0.196) and Stride‑Managed Ethernet Switches (v5.0.190) uses a built‑in encryption key that cannot be changed, meaning every device uses the same key for secure communications. If an attacker discovers this key, they could intercept, alter, or block traffic between the switches and other devices. Red Lion advises installing the newer SLX firmware (v5.3.174) to replace the hard‑coded key with unique, configurable keys.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
redlion sixnet-managed_industrial_switches_firmware <= 5.0.196
cpe:2.3:o:redlion:sixnet-managed_industrial_switches_firmware:*:*:*:*:*:*:*:*
redlion stride-managed_ethernet_switches_firmware <= 5.0.190
cpe:2.3:o:redlion:stride-managed_ethernet_switches_firmware:*:*:*:*:*:*:*:*
Original advisory text
A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running fir...
A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed Industrial switches use hard-coded HTTP SSL/SSH keys for secure communication. Because these keys cannot be regenerated by users, all products use the same key. The attacker could disrupt communication or compromise the system. CVSS v3 base score: 10, CVSS vector string: (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Red Lion Controls recommends updating to SLX firmware Version 5.3.174.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-321Use of Hard-coded Cryptographic Key
CWE-798Use of Hard-coded Credentials
Timeline
Published9 May 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-9335 · NVD
Track software like this
Free during beta