Red Lion Controls N-Tron 700 Series: Weak encryption of stored credentials
Summary
Usernames and passwords, including default factory credentials, are stored in the configuration file with weak encryption. An attacker who knows the default credentials, or who obtains the configuration file, can recover other credentials on the device and gain administrative access, which allows viewing, editing and uploading configuration files and rebooting the switch. The CNA rates the issue CVSS v4 9.3 (critical), but CISA's SSVC assessment shows no exploitation and no automatable path.
Affected
- Red Lion Controls N-Tron 700 Series firmware up to and including 3.11.0 (CISA lists <=3.11.0; the CVE record lists versions before 3.11.0; verify with the vendor)
- Red Lion Controls N-Tron 700 Series bootloader up to and including 2.0.6.1
Fixed in
- Firmware 3.11.1 or later
- Fixed bootloader version: Unknown.
Workaround
- Configure or disable the SNMP communities.
- Disable access to the web GUI.
- Restrict management access (SNMP, TFTP, web, CLI) to a dedicated management network.
- Change all default credentials.
These measures reduce the exposure but do not remove the weak encryption; only the firmware upgrade does that.
Exploitation
- No known exploitation in the wild according to CISA at the time of the advisory.
- Not listed in CISA KEV as of the latest check.
- No public proof of concept found.
Our recommendation
- Upgrade affected devices to firmware 3.11.1 or later in the next maintenance window, and check the HMS Networks advisory for the bootloader.
- Until the upgrade is done, disable the web GUI and SNMP communities, and restrict management access to a dedicated VLAN.
- Check whether any N-Tron switch is reachable from the internet or from untrusted networks and remove such exposure.
- Patch the whole advisory ICSA-26-281-01, as it also covers more serious issues such as default admin credentials and unauthenticated firmware updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-281-01 www.cisa.gov
- CISA CSAF file ICSA-26-281-01 github.com
- HMS Networks cybersecurity advisories www.hms-networks.com
- HMS Networks www.hms-networks.com
- Rapid7 Vulners record CVE-2026-28745 vulners.com
- VulDB CVE-2026-28745 vuldb.com
- Strix CVE-2026-28745 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:42.
Original description (NVD)
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.