Red Lion Controls N-Tron 700 Series: Download of code without integrity check

Summary

Firmware and bootloader updates on N-Tron 700 Series industrial switches can be performed without authentication, and the update path can be abused over the network via SNMP and TFTP. An attacker who can reach these services can push malicious firmware or bootloader files to the device, which could allow administrative access, manipulation of configuration files and repeated reboots. Exposure is highest where SNMP, TFTP or the web GUI are reachable from user, guest or internet networks.

Affected

• N-Tron 700 Series firmware 3.11.0 and earlier
• N-Tron 700 Series bootloader 2.0.6.1 and earlier

Fixed in

• Firmware 3.11.1 or later (vendor recommendation)
• Bootloader: fixed version unknown; do not assume firmware 3.11.1 covers the bootloader until the vendor confirms

Workaround

• Configure or disable the SNMP communities
• Disable access to the web GUI
• Restrict SNMP, TFTP and web access to authorised sources only
• Block or segment TFTP and SNMP from user and internet networks (own recommendation, not from a source; the update path depends on these protocols)

Exploitation

• CISA reports no known public exploitation specifically targeting these vulnerabilities at this time; CISA's wording does not rule out past exploitation.
• KEV status: No.
• Public proof of concept: none found in our research.

Our recommendation

• Create an inventory of all N-Tron 700 Series switches and their firmware and bootloader versions.
• Update firmware to 3.11.1 or later and verify the version afterwards; confirm the bootloader status with the vendor.
• Disable or restrict SNMP communities, TFTP and web GUI access.
• Do not expose these switches to the internet or user networks; use firewalls and network segmentation for control system networks.
• Monitor SNMP and TFTP traffic and firmware changes on these devices.
• Check the CISA advisory ICSA-26-281-01 for updates before acting, as it was revised on 15 October 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CISA ICS Advisory ICSA-26-281-01 www.cisa.gov
• CSAF document ICSA-26-281-01 github.com
• HMS Networks cybersecurity advisory www.hms-networks.com
• HMS Networks www.hms-networks.com
• Assurant Cyber blog on ICSA-26-281-01 www.assurantcyber.com
• Viakoo daily OT security news, 20 October 2026 www.viakoo.com
• Vulners Rapid7 entry for CVE-2026-29797 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:41.