CVE-2020-27285: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2020-27285) affects Red Lion Crimson 3.1 software (build versions prior to 3119.001). It is a Missing Authentication for Critical Function vulnerability that allows users to read and modify the database without authentication in the default configuration. The vulnerability was disclosed on January 5, 2021, and received a CVSS v3 base score of 6.5 (CISA Advisory).

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). It has a CVSS vector string of (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating it is network accessible, requires low attack complexity, needs no privileges or user interaction, and has low confidentiality and integrity impact with no availability impact (CISA Advisory).

Successful exploitation of this vulnerability allows unauthorized users to read and modify the database of the affected system. This poses significant risks to data confidentiality and integrity in critical manufacturing environments where the software is deployed (CISA Advisory).

The vulnerability is remotely exploitable and requires a low skill level to exploit. No known public exploits specifically targeting this vulnerability have been reported (CISA Advisory).

Red Lion has released a fix in build 3119.001 and recommends users update to this version or later. CISA recommends implementing additional defensive measures including minimizing network exposure for control system devices, placing systems behind firewalls, isolating them from business networks, and using secure VPN connections when remote access is required (CISA Advisory).