Red Lion Controls N-Tron 700 Series: Denial of service via web server reboot
Summary
The web server of the N-Tron 700 Series industrial Ethernet switches can be made to reboot the device by requesting a specific URL. An attacker with network access to the web interface and low-privilege credentials can script this request, for example with curl, to make the switch reboot continuously. The vulnerability is one of seven in CISA advisory ICSA-26-281-01, which also covers authentication weaknesses.
Affected
- N-Tron 700 Series firmware 3.11.0 and earlier
- N-Tron 700 Series bootloader 2.0.6.1 and earlier
Fixed in
- Firmware 3.11.1 or later
- No fixed bootloader version known.
Workaround
- Configure or disable the SNMP communities.
- Disable access to the web GUI (likely stops this URL-triggered reboot, not confirmed for this CVE).
- Keep devices off the internet and segment them behind firewalls.
- For remote access, use up-to-date VPNs.
Exploitation
- No known public exploitation has been reported to CISA.
- Not listed in CISA KEV.
- No public proof of concept found in our research; this does not prove none exists.
Our recommendation
- Inventory all N-Tron 700 switches and their firmware and bootloader versions.
- Check whether the web GUI and SNMP are reachable from outside the management network or from user LANs.
- Restrict access to the web GUI and SNMP until patched.
- Plan the upgrade to firmware 3.11.1 or later using the vendor's upgrade procedure, with a rollback plan.
- Confirm bootloader fix status with HMS Networks.
- Monitor for repeated unexpected reboots of the switches.
- Prioritise the upgrade for the whole advisory, not only this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-281-01 www.cisa.gov
- CISA CSAF file ICSA-26-281-01 github.com
- HMS Networks cybersecurity advisories www.hms-networks.com
- HMS Networks www.hms-networks.com
- Safeguard.sh analysis of ICSA-26-281-01 safeguard.sh
- SecurityFocus CVE-2026-39453 www.securityfocus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:02.
Original description (NVD)
Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.