Red Lion N-Tron 700 Series Vulnerabilities: CVEs for Default Creds, SNMP Auth Bypass & Config Exposure

Vulnerability Overview Vulnerability Name: Red Lion Controls N-Tron 700 Series Publication Date: October 8, 2026 Alert Code: ICSA-26-281-01 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Scope of Impact Affected Versions: - 700 Series <= Firmware_3.11.0 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272) - 700 Series <= Bootloader_2.0.6.1 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272) CVSS Score: v3 8.3 Vendor: Red Lion Controls Device: 700 Series Vulnerability Details 1. CVE-2026-32645: Default factory credentials possess administrative access and remain valid even after other administrator accounts are configured. 2. CVE-2026-39460: Usernames and passwords (including default factory credentials) are stored in plaintext within configuration files. Users with administrative privileges can view these configuration files via the CLI or Web interface, or export them via TFTP. 3. CVE-2026-28745: Usernames and passwords (including default credentials) are stored in configuration files using weak encryption. If default credentials are known by a malicious actor, they can be used to obtain other credentials. 4. CVE-2026-33367: SNMP can be used to perform administrative actions, such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades, all without authentication. 5. CVE-2026-29797: Authentication is not required to update firmware or bootloaders, allowing malicious files to be easily pushed to the device. Furthermore, anyone can use the same software to scan the network for N-Tron devices and push/pull firmware via SNMP/TFTP without authentication. 6. CVE-2026-39453: Navigating to a specific URL on the switch's web server causes the switch to restart. This can be automated using tools like curl, creating a Denial of Service (DoS) condition that causes the switch to repeatedly restart. 7. CVE-2026-33272: A malicious user with physical access can perform a factory reset on the switch without authentication, gain administrative access using default administrator credentials, and save changes to the configuration file so that these changes persist the next time the switch boots normally. Remediation Recommended Practices: - Minimize network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is necessary, use more secure communication methods such as Virtual Private Networks (VPNs), and update VPNs regularly. - Conduct appropriate impact analysis and risk assessments before implementing defense measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and report findings to CISA. - Do not click links in unsolicited emails or open attachments. - Refer to CISA's guidelines on avoiding email scams and social engineering attacks. Additional Information Background: - Critical Infrastructure Sectors: Commercial Facilities, Communications, Critical Manufacturing, Information Technology - Deployment Country/Region: Global - Company Headquarters Location: Sweden Acknowledgments: - Gabrianna (Ria) Milloway from Idaho National Laboratory reported these vulnerabilities to CISA. Legal Notice and Terms of Use: - This product is subject to this notice and the privacy and use policy. Revision History: - Initial Publication Date: 2026-10-08 Tags: - Sectors: Commercial Facilities Sector, Communications Sector, Critical Manufacturing Sector, Information Technology Sector - Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Satel Netco Design Grid Protection Alliance openPDC and openHistorian Hitachi Energy SOI Johnson Controls EasyIO FG Feedback Please share your thoughts. We have recently updated the anonymous product survey and welcome your feedback. Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov: Official website of the U.S. Department of Homeland Security Links: About CISA, Budget and Performance, DHS.gov, FOIA Requests, No FEAR Act, Office of Inspector General, Privacy Policy, Subscribe, White House, USA.gov, Website Feedback --- Note: POC code or exploit code was not included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Red Lion N-Tron 700 Series Vulnerabilities: CVEs for Default Creds, SNMP Auth Bypass & Config Exposure

More from this source