Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1
Security / news
Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1
CISA's October 8 advisory rates the default-credential flaw 6.0 on CVSS 3.1 and 9.2 on 4.0, and lists no fixed bootloader.
The N-Tron 700 Series industrial Ethernet switches from Red Lion Controls accept administrative SNMP commands without authentication, so anyone on the network can read configuration files, change accounts and push firmware, according to CISA advisory ICSA-26-281-01, published October 8. The vendor fix is firmware 3.11.1. CISA lists no fixed bootloader version.
The advisory covers seven CVEs and credits Gabrianna (Ria) Milloway of Idaho National Laboratory with the report. CISA says it knows of no public exploitation. It lists the affected sectors as commercial facilities, communications, critical manufacturing and information technology.
Seven CVEs, two scoring systems
| CVE | Weakness | CVSS 3.1 | CVSS 4.0 |
|---|---|---|---|
| CVE-2026-32645 | Hard-coded credentials | 6.0 | 9.2 |
| CVE-2026-39460 | Insufficiently protected credentials | 8.1 | 9.3 |
| CVE-2026-28745 | Passwords in recoverable format | 7.5 | 9.3 |
| CVE-2026-33367 | Missing authentication, SNMP admin actions | 8.1 | 9.3 |
| CVE-2026-29797 | Firmware update without integrity check | 7.1 | 8.4 |
| CVE-2026-39453 | Reachable assertion, web server | 8.3 | 8.5 |
| CVE-2026-33272 | Authentication bypass, alternate path | 4.9 | 6.8 |
The score understates the default-credential flaw in its 3.1 form. CVE-2026-32645 rates 6.0 because the vector is local and needs high privileges, yet CISA's text says default factory credentials with administrative access are enabled and persist after other admin accounts are configured. The 4.0 vector, which counts impact on connected systems, puts it at 9.2.
The two scores differ by 3.2 points on that one CVE and by 2.2 on CVE-2026-28745. Defenders sorting a patch queue by 3.1 alone would rank both below the web server reboot bug, which rates 8.3 and can only cause a denial of service.
What an attacker on the network can do
CVE-2026-33367 lets SNMP perform administrative actions without authentication, including retrieving configuration files, changing accounts or settings, and changing firmware or bootloader versions. CVE-2026-39460 compounds it: usernames and passwords, including the factory defaults, sit in plaintext in the configuration file, and a TFTP transfer can be started through SNMP without authentication.
CVE-2026-29797 means firmware or bootloader updates need no authentication either, so a scan for N-Tron devices is enough to find targets. CVE-2026-39453 is the mildest: a request to a certain URL reboots the switch, and a script can repeat it. CVE-2026-33272 needs physical access to boot from factory settings.
Which firmware is affected
CISA lists firmware up to and including 3.11.0 and bootloader up to and including 2.0.6.1. The record for CVE-2026-39453 on OpenCVE gives the firmware range as earlier than 3.11.0 and lists 3.11.1 as unaffected. A switch running exactly 3.11.0 falls in one range and not the other. Upgrading to 3.11.1 settles it, but no bootloader fix is listed, so the bootloader remains a gap.
Mitigations before the upgrade
The vendor's mitigations are to configure or disable SNMP communities and to disable access to the web GUI. CISA adds the usual advice to keep control networks off the internet and behind firewalls. OpenCVE gives CVE-2026-39453 an EPSS of 0.00289, and none of the seven is in CISA's exploited catalogue.
The advisory points to HMS Networks' cybersecurity page for the vendor notice. As fetched on October 12, that page listed no N-Tron entry; its most recent visible item was dated March 9, 2026, and a "Load more" button hid older ones. The vendor's own advisory text was not available to this report.
Not the first N-Tron advisory
On August 28, 2020, the Canadian Centre for Cyber Security issued alert AV20-317 for the N-Tron 702-W and 702M12-W, covering all versions and pointing to ICS-CERT advisory ICSA-20-240-01. It said "Exploitation of some of these vulnerabilities could result in the remote execution of arbitrary code." The 2020 alert listed no CVE identifiers, so it cannot be matched to this set.
Operators should move every N-Tron 700 Series switch to 3.11.1 and turn off SNMP communities they do not use. For another credential failure, see the site's report on the Danish CPR breach and CISA's October 8 additions.
Sources
More in Security
- 01Ledger Confirms an Implant in a Nano X Sold Through CryptoBilis, but Not That It Caused the TheftsLedger said on October 10 that one affected customer's wallet held an unauthorized hardware implant. It has not said how many devices are modified or how the losses happened.
- 02Ivanti Connect Secure Chain Gives Root on Patched Appliances, and One Link Still Has No FixVolexity says an actor it calls UTA0576 chained three flaws from October 3. Ivanti patched two on October 13 and has not scheduled the third beyond "the coming weeks".
- 03SonicWall SMA1000 CVSS 10.0 Flaw Draws 135 Attempts From Two IP AddressesPrevidian's telemetry comes from a single sensor, and SonicWall had not updated advisory SNWLID-2026-0017 to mention exploitation when The Hacker News reported on Oct. 12.
- 04Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven DomainsAdvisory AA26-281A lists eight exploited CVEs dating to 2014, and five of them were added to CISA's KEV catalog only with its release.