CVE-2019-10990

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321 CWE-798

Affected software

Vendor	Product	Versions
n/a	Red Lion Controls Crimson (Windows configuration software)	Version 3.0 and prior, Version 3.1 prior to release 3112.00

References

https://www.us-cert.gov/ics/advisories/icsa-19-248-01Mitigation, Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-19-248-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Sep 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-109919.8In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation CVE-2019-109925.5Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cause information disclo CVE-2019-109939.8In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute a CVE-2019-109943.3Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtai CVE-2019-109958.8ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phas CVE-2019-109967.8Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited wh CVE-2019-109975.9An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LT CVE-2019-109986.8An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LT CVE-2019-109998.8The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a rem CVE-2019-11006.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-110006.5An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information D CVE-2019-110017.2On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" function