Security Advisory

CVE-2023-40151: Red Lion SixTRAK/VersaTRAK RTU Authentication-Challenge Bypass over TCP (Water/Wastewater Telemetry)

Last updated:
  • CVE-2023-40151

CVE-2023-40151 is an authentication-bypass vulnerability in Red Lion SixTRAK and VersaTRAK Series remote telemetry units (RTUs) commonly used for SCADA telemetry at water and wastewater lift stations and pump stations: the device's Sixnet UDR management protocol requires an authentication challenge for commands sent over UDP/IP, but accepts the same commands over TCP/IP with no authentication at all, and NVD rates the resulting critical access to administrative device functions 9.8 (critical) on CVSS v3.1.

Vulnerability summary

9.8

Critical

1.1%

EPSS score (FIRST)

No

CISA KEV catalog

2023-11-21

Published

Vulnerability ID: CVE-2023-40151 · Source: NVD

Affected components

ComponentCPEVersion range
Red Lion SixTRAK / VersaTRAK Series RTU firmware (Sixnet UDR management protocol)cpe:2.3:o:redlioncontrols:st-ipm-6350_firmware:4.9.114:*:*:*:*:*:*:*Confirmed-vulnerable firmware builds include ST-IPM-6350 4.9.114, ST-IPM-8460 6.0.202, VT-MIPM-135-D 4.9.114, VT-MIPM-245-D 4.9.114, VT-IPM2M-213-D 4.9.114 and VT-IPM2M-113-D 4.9.114; fix detailed in Red Lion Security Advisory RLCSIM-2023-05

What does this mean for affected devices?

CVE-2023-40151 affects Red Lion SixTRAK and VersaTRAK Series RTUs, distributed-control remote telemetry units that Red Lion (now part of HMS Networks) lists Water/Wastewater among the industry verticals its products serve (Red Lion Controls).

NVD's description states: "When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authentication challenge" (NVD).

CISA's ICS-CERT enrichment program rated the flaw a Secondary CVSS v3.1 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-749, Exposed Dangerous Method or Function), while NVD's own Primary rating is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — both network-reachable, no privileges or user interaction required, full impact to confidentiality, integrity and availability (NVD).

NVD's configuration data confirms the vulnerable firmware spans multiple SixTRAK/VersaTRAK hardware models: ST-IPM-6350 (firmware 4.9.114), ST-IPM-8460 (6.0.202), VT-MIPM-135-D, VT-MIPM-245-D, VT-IPM2M-213-D and VT-IPM2M-113-D (all 4.9.114) (NVD).

A closely related CVE, CVE-2023-42770, covers the same underlying TCP/UDP authentication-challenge gap under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function), and is fixed by the same vendor advisory. Both CVEs are documented in Red Lion's own Security Advisory RLCSIM-2023-05, "Authentication Bypass and Remote Code Execution," cited by NVD with the reference tags Mitigation, Patch and Vendor Advisory, and in CISA's ICS advisory ICSA-23-320-01 (Red Lion Security Advisory RLCSIM-2023-05, CISA ICSA-23-320-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0115 (67.1th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

Operators of affected SixTRAK/VersaTRAK RTUs — including those used for remote water/wastewater lift-station or well telemetry — should apply the firmware updates and configuration guidance in Red Lion's RLCSIM-2023-05 advisory and should not assume that enabling UDR authentication alone is sufficient, since the TCP/IP path bypasses it entirely.

How to fix this class of issueThis advisory's weakness class is Authentication bypass. Our practical guide covers how to detect, fix, verify and disclose it: How to fix authentication bypass in embedded firmware.

Evidence

  • Red Lion SixTRAK and VersaTRAK Series RTUs with UDR authentication enabled challenge Sixnet UDR messages sent over UDP/IP, but accept the same messages over TCP/IP with no authentication challenge at all; without authentication enabled, the shell can execute commands with the highest privileges. — NVD
  • CISA ICS-CERT Secondary CVSS v3.1 10.0 (CWE-749); NVD Primary CVSS v3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
  • Vulnerable firmware confirmed on ST-IPM-6350 (4.9.114), ST-IPM-8460 (6.0.202), VT-MIPM-135-D, VT-MIPM-245-D, VT-IPM2M-213-D and VT-IPM2M-113-D (all 4.9.114). — NVD
  • Documented in Red Lion Security Advisory RLCSIM-2023-05 ("Authentication Bypass and Remote Code Execution") and CISA ICS advisory ICSA-23-320-01, alongside the closely related CVE-2023-42770. — Red Lion Security Advisory RLCSIM-2023-05
  • Red Lion Controls (HMS Networks) lists Water/Wastewater among the industry verticals its products, including remote telemetry RTUs, serve. — Red Lion Controls
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0115 (67.1th percentile) as of 2026-11-08. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2023-46805: Ivanti Connect Secure Auth Bypass — CVSS 8.2, High severityCISA KEVCVE-2023-46805: KEV auth bypass in Ivanti Connect Secure/Policy Secure, chained with CVE-2024-21887 for RCE. Sourced to NVD, CISA KEV, FIRST EPSS.CVE-2023-49105: ownCloud WebDAV Pre-Signed URL Authentication Bypass (KEV) — CVSS 9.8, Critical severityCISA KEVCVE-2023-49105: KEV authentication bypass in ownCloud's WebDAV API lets an attacker access, modify or delete any file for accounts with no signing-key configured. Sourced to NVD, CISA and ownCloud.CVE-2023-4957: Zebra ZT410 Industrial Label Printer Web Admin Authentication Bypass — CVSS 4.3, Medium severityCVE-2023-4957: an attacker on the same network as a Zebra ZT410 industrial ZPL label printer can change the device's web-management username and password by sending a crafted request, if the printer's Protected Mode setting (disabled by default) has not been turned on. NVD Primary CVSS 4.3; sourced to NVD and Spain's INCIBE-CERT.

Sources

  1. NVD
  2. Red Lion Security Advisory RLCSIM-2023-05
  3. CISA ICSA-23-320-01
  4. Red Lion Controls
  5. CISA KEV
  6. FIRST EPSS

Frequently asked questions

What can an attacker actually do by exploiting CVE-2023-40151?

A remote attacker can send Sixnet UDR management commands to the RTU over TCP/IP and the device will execute them with no authentication challenge at all, even though the same commands sent over UDP/IP would be challenged; if user authentication is not enabled, the resulting shell can execute commands with the highest privileges (per NVD).

Which Red Lion RTU models and firmware builds are confirmed vulnerable?

NVD's configuration data confirms ST-IPM-6350 firmware 4.9.114, ST-IPM-8460 firmware 6.0.202, and VT-MIPM-135-D, VT-MIPM-245-D, VT-IPM2M-213-D and VT-IPM2M-113-D all at firmware 4.9.114 (per NVD).

Is CVE-2023-40151 related to any other Red Lion vulnerability?

Yes. CVE-2023-42770 covers the same underlying TCP/UDP authentication-challenge gap (CWE-288/CWE-306) and is fixed by the same Red Lion Security Advisory RLCSIM-2023-05, which also covers CVE-2023-40151 (per Red Lion Security Advisory RLCSIM-2023-05; per CISA ICSA-23-320-01).

Is CVE-2023-40151 being exploited in the wild, and how should operators respond?

It is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST's EPSS model puts the exploitation probability at 0.0115 (67.1st percentile) as of 2026-11-08; operators of SixTRAK/VersaTRAK RTUs used for water/wastewater telemetry should apply the firmware and configuration guidance in RLCSIM-2023-05 rather than relying on UDR authentication alone, since it does not cover the TCP/IP path (per CISA KEV; per FIRST EPSS; per Red Lion Security Advisory RLCSIM-2023-05).