Red Lion N-Tron 700 Series: Plaintext storage of credentials in configuration file
Summary
Usernames and passwords, including default factory credentials, are stored in plaintext in the configuration file of the N-Tron 700 Series industrial Ethernet switches. An attacker with administrator rights can read the file via CLI or export it by TFTP from the web interface. A TFTP transfer can also be triggered via SNMP without authentication, so the credentials may be exposed to an attacker who can reach the management interfaces.
Affected
- N-Tron 700 Series firmware up to and including 3.11.0
- N-Tron 700 Series bootloader up to and including 2.0.6.1
Fixed in
- Firmware 3.11.1 or later (vendor fix, per Red Lion Controls and HMS Networks)
- Fixed bootloader version: Unknown.
Workaround
- Configure or disable the SNMP communities
- Disable access to the web GUI
- Change all default credentials
- Restrict TFTP and SNMP access to a dedicated management network
Exploitation
- CISA SSVC: no exploitation known, automatable: no, technical impact: total
- Not listed as known exploited (KEV) at the time of research
- Public proof of concept: Unknown
Our recommendation
- Check whether N-Tron 700 switches are in use and whether their management interfaces are reachable from untrusted networks
- Upgrade firmware to 3.11.1 or later and confirm the bootloader version with the vendor
- Disable or restrict SNMP and the web GUI, and keep management interfaces behind a firewall or VPN
- Change all default credentials and remove stored configuration files from shared drives
- Monitor SNMP and TFTP traffic to the switches
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-281-01 www.cisa.gov
- CISA CSAF document ICSA-26-281-01 (JSON) github.com
- HMS Networks cybersecurity advisory www.hms-networks.com
- HOL vulnerability record CVE-2026-39460 hol.org
- Safeguard summary ICSA-26-281-01 safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:41.
Original description (NVD)
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.