Red Lion Controls N-Tron 700 Series: Missing authentication for critical function
Summary
The N-Tron 700 Series industrial Ethernet switches accept SNMP requests without authentication. An unauthenticated attacker who can reach the switch can retrieve configuration files, change user accounts or device settings, and start firmware or bootloader upgrades or downgrades. The attack requires network access to the switch's SNMP or management services.
Affected
- N-Tron 700 Series firmware 3.11.0 and earlier
- N-Tron 700 Series bootloader 2.0.6.1 and earlier
Fixed in
- Firmware 3.11.1 or later
- Bootloader: Unknown.
Workaround
- Configure or disable the SNMP communities
- Disable access to the web GUI
- Restrict access to the management interfaces to trusted administration networks
Exploitation
- CISA reports no known public exploitation of these vulnerabilities at this time.
- Not known to be on the CISA KEV catalog.
- No public proof of concept found; not verified.
Our recommendation
- Inventory all N-Tron 700 switches and their firmware and bootloader versions.
- Update firmware to 3.11.1 or later in a maintenance window, after checking operational impact with the plant owner.
- Until patched, disable SNMP communities that are not needed and the web GUI, and block SNMP and TFTP from IT, guest and internet networks.
- Monitor for unexpected configuration changes, reboots and TFTP transfers.
- Check the HMS Networks upgrade document for the bootloader fix, as no fixed bootloader version is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-281-01 www.cisa.gov
- CISA CSAF JSON ICSA-26-281-01 github.com
- HMS Networks cybersecurity advisory www.hms-networks.com
- HMS Networks www.hms-networks.com
- Trout: SNMP in OT environments www.trout.software
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:40.
Original description (NVD)
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.