CVE-2019-10990
MEDIUMRed Lion Controls Crimson <3.1-3112.00 - Info Disclosure
Title source: llmDescription
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.
References (1)
Core 1
Core References
Mitigation, Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-19-248-01
Scores
CVSS v3
6.5
EPSS
0.0133
EPSS Percentile
67.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-321
CWE-798
Status
published
Products (2)
None/Red Lion Controls Crimson (Windows configuration software)
Version 3.0 and prior, Version 3.1 prior to release 3112.00
redlion/crimson
< 3.0
Published
Sep 23, 2019
Tracked Since
Feb 18, 2026