CVE-2016-9335
📋 TL;DR
This vulnerability involves hard-coded cryptographic keys in Red Lion industrial switches that cannot be changed by users, allowing attackers to decrypt secure communications, impersonate devices, or disrupt operations. Affected systems include Sixnet-Managed Industrial Switches and Stride-Managed Ethernet Switches running specific vulnerable firmware versions.
💻 Affected Systems
- Red Lion Controls Sixnet-Managed Industrial Switches
- Red Lion Controls Stride-Managed Ethernet Switches
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems allowing attackers to intercept/manipulate all communications, disrupt critical infrastructure operations, or gain persistent access to industrial networks.
Likely Case
Attackers decrypting sensitive industrial communications, performing man-in-the-middle attacks, or gaining unauthorized access to network segments containing vulnerable switches.
If Mitigated
Limited impact through network segmentation and monitoring, though communications remain vulnerable to decryption if attackers obtain the hard-coded keys.
🎯 Exploit Status
Exploitation requires obtaining the hard-coded keys but once obtained, attacks require minimal technical skill. The CVSS vector indicates no authentication required and low attack complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SLX firmware Version 5.3.174
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02
Restart Required: Yes
Instructions:
1. Download SLX firmware Version 5.3.174 from Red Lion Controls. 2. Backup current configuration. 3. Upload new firmware via web interface or console. 4. Reboot switch. 5. Verify firmware version after reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable switches in separate VLANs with strict firewall rules to limit attack surface
Disable Remote Management
allDisable HTTP/HTTPS/SSH management interfaces if not required for operations
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted IP addresses to communicate with switches
- Monitor network traffic for unusual SSL/SSH handshakes or decryption attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > About) or console command 'show version'. If version matches affected versions, device is vulnerable.Check Version:
show version (console) or check System > About in web interfaceVerify Fix Applied:
After patching, verify firmware version shows 5.3.174 or higher in System > About page.📡 Detection & Monitoring
Log Indicators:
- Multiple failed SSL/SSH connection attempts
- Unexpected certificate validation errors
- Unusual management interface access patterns
Network Indicators:
- SSL/TLS handshakes using unexpected certificates
- SSH connections with unusual key exchanges
- Traffic decryption attempts on switch management ports
SIEM Query:
source="industrial_switch" AND (event_type="auth_failure" OR certificate_validation="failed")