Red Lion DA50N
Act Now9.6ICS-CERT ICSA-22-104-03Apr 14, 2022
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Red Lion DA50N contains multiple vulnerabilities (CWE-345, CWE-521, CWE-1104) involving weak authentication, insecure credential storage, and related authentication bypass issues. The device allows installation of unsigned firmware images, weak default passwords (admin, rlcuser, techsup accounts), and optional services (SSH, telnet) that can be left enabled. Red Lion has marked the DA50N series as end-of-life and does not intend to release patches. Successful exploitation could result in data compromise, modification, and denial of service.
What this means
What could happen
An attacker with network access to a DA50N device could install malicious firmware, change operational settings, extract credentials, or shut down remote terminal services. This could disrupt SCADA monitoring and control functionality in water and utility automation systems.
Who's at risk
Water authorities and utilities using Red Lion DA50N remote terminal units (RTUs) or human-machine interfaces (HMIs) for SCADA monitoring and control. The DA50N is commonly deployed in telemetry and process automation roles where unauthorized access could disrupt operations.
How it could be exploited
An attacker could exploit weak default credentials (admin, rlcuser, techsup) to gain unauthorized access to the device. Alternatively, the attacker could place a malicious firmware image on an SD card or intercept downloads by exploiting weak TLS certificate validation, allowing unsigned firmware installation that gives full device control.
Prerequisites
- Network access to the DA50N device
- Knowledge of default account names (admin, rlcuser, techsup)
- Physical access to SD card slot (for firmware insertion attack)
- Ability to intercept or redirect firmware downloads over the network
No patch available (end-of-life product)Default credentialsWeak authenticationRemotely exploitableAffects operational visibility and control systems
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (1)
ProductAffected VersionsFix Status
DA50N: All versionsAll versionsNo fix (EOL)
Remediation & Mitigation
0/9
Do now
0/5WORKAROUNDChange default passwords for admin, rlcuser, and techsup accounts to unique, strong passwords
WORKAROUNDDisable SSH service if not required for operations
WORKAROUNDDisable telnet service if not already disabled
HARDENINGRestrict physical access to the DA50N device to prevent unauthorized SD card firmware insertion
WORKAROUNDOnly download firmware images from the official Red Lion website and verify TLS certificate validity before download
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
HOTFIXUpgrade to Red Lion DA50A or DA70A series devices
HARDENINGImplement network segmentation to isolate DA50N devices from the business network and restrict internet access
HARDENINGDeploy firewalls to limit network access to the device to only authorized IP addresses and ports required for operations
HARDENINGStore firmware images and configuration files in a secure, access-controlled location if stored before deployment
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/5affbe3e-52ce-4bd0-adbd-d6b31450edcd