On 8 October 2026 CISA published ICS advisory ICSA-26-281-01 for the Red Lion Controls N-Tron 700 Series industrial switches. It was revised on 15 October to update CVSS v4.0 scores and fix links. CISA says "no known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." That is a statement about reports to CISA, not proof that nobody has tried.
What is affected
- Firmware 3.11.0 and earlier
- Bootloader 2.0.6.1 and earlier
- Fixed in firmware 3.11.1 or later
- Sectors listed: Commercial Facilities, Communications, Critical Manufacturing and Information Technology, deployed worldwide
The seven flaws
| CVE | Weakness | CVSS v3.1 | CVSS v4.0 |
|---|---|---|---|
| CVE-2026-32645 | CWE-798 hard-coded credentials | 6.0 | 8.3 |
| CVE-2026-39460 | CWE-522 insufficiently protected credentials | 8.1 | 8.6 |
| CVE-2026-28745 | CWE-257 recoverable passwords | 7.5 | 9.3 |
| CVE-2026-33367 | CWE-306 missing authentication | 8.1 | 8.6 |
| CVE-2026-29797 | CWE-494 code download without integrity check | 7.1 | 7.1 |
| CVE-2026-39453 | CWE-617 reachable assertion | 8.3 | 7.2 |
| CVE-2026-33272 | CWE-288 alternate path bypass | 4.9 | 5.2 |
Per CISA, in plain terms:
- CVE-2026-32645: default factory admin credentials stay active after other admins are configured.
- CVE-2026-39460: usernames and passwords, including defaults, sit in plaintext in the config file, and a TFTP export can be triggered through SNMP without authentication.
- CVE-2026-28745: config credentials use weak encryption.
- CVE-2026-33367: SNMP can retrieve configs, change accounts and upgrade or downgrade firmware with no authentication.
- CVE-2026-29797: firmware and bootloader updates need no authentication.
- CVE-2026-39453: one URL on the web server reboots the switch, which can be scripted into a denial of service.
- CVE-2026-33272: someone with physical access can boot from factory settings and use default admin credentials.
What is confirmed, reported and unknown
- Confirmed by CISA: versions, CVEs, scores, the fix and the exploitation statement.
- Reported by others: not used. This post relies on CISA only.
- Unknown: how many devices are exposed to the internet, and whether anyone is exploiting them in a way that has not been reported.
How to check if you're exposed
Inventory switches by model and firmware, then look for ones reachable on management protocols.
snmpwalk -v2c -c public SWITCH_IP 1.3.6.1.2.1.1.1.0
Use that only against devices you own. If a public community string answers, treat the switch as exposed. Check firmware in the web GUI or CLI against 3.11.0.
What to do now
- Upgrade to 3.11.1 or later. HMS Networks publishes the upgrade procedure.
- Until then, configure or disable SNMP communities and disable the web GUI, as the vendor suggests.
- Change every default credential and keep the config file off shared drives.
- Keep management interfaces off the internet and behind a firewall or VPN, per CISA's general guidance.
- Restrict TFTP to a management network.
How this could have been avoided
- No default or hard coded credentials. Four of the seven flaws are about credential handling.
- Authentication on every management function. SNMP changing firmware without login is the core problem.
- Signed firmware. A device that checks signatures cannot be told to accept anything.
- Network side: management plane isolation. Switches that sit on a separate management network give attackers less to reach.
- Asset inventory. You cannot upgrade a switch you do not know you have.
Try it yourself
Count the OT switches in your plant that have a default or shared admin password. Fix the highest risk ones first.
Click through it at your own pace, or open it full screen.
Quick check
Which firmware version fixes these flaws?
3.11.1 or later, per the vendor and CISA.
Is exploitation known?
CISA says none specifically targeting these flaws has been reported to it at the time of the advisory.
