Advisories › Red Lion Controls › ICSA-26-281-01
Red Lion Controls N-Tron 700 Series - Update A: 7 CVEs, High 8.3
Summary
CISA reports 7 vulnerabilities in Red Lion Controls 700 Series. Weakness types: Use of Hard-coded Credentials, Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format (+4 more). Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Highest CVSS v3 score: 8.3 (High), exploitable over the network.
What to do: Prioritize: Red Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.
Why this matters for oil & gas: Red Lion HMIs/RTUs and cellular routers are common at remote sites.
At a glance
- Vendor
- Red Lion Controls
- Products
- 700 Series
- CVEs
- CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272
- Highest CVSS v3
- 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Communications, Critical Manufacturing, Information Technology
- Deployed
- Worldwide
- Vendor HQ
- Sweden
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-32645 | Use of Hard-coded Credentials | 6.0 | – | No | Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. |
| CVE-2026-39460 | Insufficiently Protected Credentials | 8.1 | – | No | Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication. |
| CVE-2026-28745 | Storing Passwords in a Recoverable Format | 7.5 | – | No | Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system. |
| CVE-2026-33367 | Missing Authentication for Critical Function | 8.1 | – | No | SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades-all without any authentication. |
| CVE-2026-29797 | Download of Code Without Integrity Check | 7.1 | – | No | No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP. |
| CVE-2026-39453 | Reachable Assertion | 8.3 | – | No | Navigating to a certain URL on the switch's web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots. |
| CVE-2026-33272 | Authentication Bypass Using an Alternate Path or Channel | 4.9 | – | No | A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally. |
Affected products (2)
- Red Lion Controls 700 Series: <=Firmware_3.11.0
- Red Lion Controls 700 Series: <=Bootloader_2.0.6.1
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Red Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.
- Mitigation: The upgrade procedure document can be found at https://www.hms-networks.com/. link
- Mitigation: The advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.