CVE-2023-5719: Red Lion Crimson Improper Neutralization of Null Byte or NUL Character

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-06 · updated 2026-06-17
Weakness: CWE-158

Description

The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.

Affected products

Red Lion Controls Crimson (Windows configuration software): before 3.2; 3.2-build_3.2.0008.0, 3.2-build_3.2.0014.0, 3.2-build_3.2.0015.0, 3.2-build_3.2.0016.0, 3.2-build_3.2.0020.0, 3.2-build_3.2.0021.0 (+15) — fixed in 3.2

How to fix

Upgrade to a fixed version: Red Lion Controls Crimson (Windows configuration software) 3.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-5719 or the next vulnerability affects your stack