EUVD-2026-95811
GHSA-596f-jhxr-2xgr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device over network
-
DeliveryAuthenticate with known default credentials
-
ExploitRetrieve configuration file
-
ExecutionDecrypt weakly-encrypted stored credentials
-
ImpactReuse recovered credentials for broader access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Irreversible password storage
|
| Exploitation Conditions | Exploitation requires the attacker to possess the Red Lion 700 Series default credentials (documented/known defaults) and to be able to read the device configuration file where usernames and passwords are stored under weak, reversible encryption; with those, additional system credentials can be recovered. Limiting factors that reduce real-world exploitability: deployments that have changed the default credentials, restricted network/management-interface access to the device, and the fact that value is realized only after recovered credentials are reused for further access. The input provides no evidence of a non-default configuration requirement - the default-credential storage behavior appears to be the default state. |
| Impact | The input assigns CVSS 4.0 base 9.3 (Critical) with vector AV:N/AC:L/PR:N/UI:N and full VC:H/VI:H/VA:H impact, which on paper describes a trivially remote, unauthenticated, high-impact flaw. However, the description introduces a dependency that the vector does not capture: exploitation hinges on a malicious user KNOWING the default credentials, after which weakly-encrypted stored credentials (CWE-257) can be recovered. This is really a credential-disclosure/weak-cryptography issue whose severity is inflated by chaining to downstream account takeover. No EPSS score, no CISA KEV entry, and no public exploit (POC) were provided in the input, so there is currently no public exploit identified at time of analysis and no evidence of active or automated exploitation. Signal tension to verify: the vendor rates all three impact metrics High, but the direct technical impact per the CWE-257 'information disclosure' framing is primarily confidentiality - integrity/availability impact only materializes after the recovered credentials are reused. Because this is a niche OT device (Red Lion 700 Series) reported via ICS-CERT, real-world risk is better characterized as targeted/OT-focused rather than mass internet exploitation despite the high CVSS. Treat as a high-priority patch for affected OT operators, but the 9.3 should not be read as equivalent to an unauthenticated internet-wide RCE. |
| Exploit ScenarioDerived | A malicious actor with network reachability to a Red Lion 700 Series device uses the publicly documented default credentials to access the device and retrieve its configuration file. Because usernames and passwords are stored with weak, reversible encryption, the attacker decrypts additional operator/administrator credentials and reuses them to expand access across the device or connected systems. No public proof-of-concept was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 09, 2026
Weak, reversible encryption of usernames and passwords stored in the configuration file of Red Lion Controls 700 Series devices lets an attacker who holds the documented default credentials read the configuration and recover additional system credentials for reuse elsewhere on the device or network. The affected product line is captured by CPE cpe:2.3:a:red_lion_controls:700_series:*:*:*:*:*:*:*:*, meaning the vendor tracks the issue at the product-line level rather than against a specific firmware build, and the flaw is classified as CWE-257 (storage of passwords in a recoverable format). Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network reachable but requiring the attacker to already possess valid credentials (PR:L), with confidentiality-only impact - which is substantially lower than the CVSS 4.0 base score of 9.3 reported in the source data; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided. Real-world risk therefore concentrates on deployments that retain default credentials and expose the management interface to untrusted networks, and on whether the recovered credentials are reused in a way that grants further access.
Earlier versions of this analysis (1)
Weakly encrypted credentials, including factory default usernames and passwords, are stored in the Red Lion Controls 700 Series configuration file in a recoverable format, so anyone able to obtain that file can decrypt the stored passwords and potentially use them to reach other credentials on the device. The authoritative independent assessment scores this as a confidentiality-only impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), stressing that exploitation requires the target device to still be using factory default credentials that the attacker already knows and that the attacker can reach the management interface and retrieve the configuration file; the supplier-submitted vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) instead characterises the impact as availability and requires no privileges, so the two severity signals are moderate and partially conflicting. No confirmed actively exploited status (no CISA KEV listing) and no public exploit identified at time of analysis, though the CISA ICS advisory (ICSA-26-281-01) confirms the issue is a real, vendor-acknowledged ICS disclosure.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the provided intelligence, so the primary action is to consult the vendor advisory pages (https://www.hms-networks.com/cybersecurity and https://www.hms-networks.com/) and the CISA advisory ICSA-26-281-01 for a current firmware release and its installation guidance; because the CPE version field is a wildcard, confirm the fix against the exact model and firmware in use before assuming coverage. Until a fix is confirmed, the highest-value compensating control is to change every default credential on the device immediately - this directly removes the precondition our assessment identifies (possession of the documented defaults) and, unlike most workarounds, carries no functional side effects, though it does not fix the weak encryption of the stored entries. In parallel, restrict reachability of the device management interface to a trusted management VLAN or jump host, or block it at the OT firewall, accepting that this complicates legitimate remote administration and firmware updates; segment the 700 Series away from routable corporate networks and monitor for unexpected authentication attempts and configuration-file reads. Because the recovered credentials are useful only if reused, audit and rotate any shared or reused account credentials across the device and adjacent systems, and treat the device configuration file as sensitive material that must not be copied off-box. If the vendor confirms the encryption cannot be strengthened in the current firmware generation, treat the stored secrets as effectively plaintext and plan rotation of every credential exposed through the configuration store.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in the configuration subsystem of the Red Lion Controls 700 Series, an industrial/OT device family whose management interface is reachable over the network (AV:N). Usernames, passwords, and the default credentials shipped with the device are written to the configuration file using encryption that is weak enough to be reversed, which is the textbook CWE-257 pattern of storing secrets in a recoverable form: the protection does not depend on an attacker never seeing the file, but it effectively does, because anything readable can be decrypted or brute-forced back to plaintext. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms that the exploitation path is confidentiality-only - no integrity or availability impact, and no scope change - and that the attacker must already hold valid credentials (PR:L) rather than being truly unauthenticated as the 9.3 CVSS 4.0 vector (PR:N, VC:H/VI:H/VA:H) would imply. The chain is: know or obtain the default credentials, authenticate (or otherwise access the configuration store), decrypt the weakly protected entries, and then reuse the recovered secondary credentials. The input provides no evidence that any non-default configuration is required; the default-credential storage behavior appears to be the shipped state, which is why ICS-CERT published this under advisory ICSA-26-281-01.
Know when 700 Series gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploitation requires using known default credentials to reach stored secrets, so PR:L rather than PR:N; the direct technical impact is confidentiality of recovered credentials (C:H), with no direct integrity or availability loss.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.
Executive ViewAI
CVE-2026-28745 affects Red Lion Controls 700 Series devices, where weakly encrypted configuration credentials can be recovered by an authenticated attacker using documented default credentials and then reused across the device or network. Because no vendor-released patch is identified at time of analysis and no public exploit has been identified, the primary business risk is credential compromise and lateral movement within industrial or remote environments, not immediate widespread exploitation. Leadership should prioritize credential rotation, network segmentation, and vendor engagement for this product line.
No vendor-released patch identified at time of analysis; interim mitigations include changing default credentials immediately, restricting network access to management/config interfaces, segmenting affected devices, rotating all potentially exposed credentials, monitoring for unauthorized configuration access, and applying vendor firmware once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in 700 Series
View allPlaintext credential storage in Red Lion Controls' 700 Series industrial devices exposes usernames, passwords, and uncha
Red Lion Controls 700 Series devices expose SNMP functions that can be used to perform administrative operations - retri
Remote attackers holding low-privilege credentials can crash and reboot Red Lion Controls 700 Series switches by request
Firmware and bootloader updates on Red Lion Controls' N-Tron 700 Series industrial Ethernet switches can be pushed or pu
Factory default administrator credentials on Red Lion Controls 700 Series devices remain active and cannot be removed by
Physical access to a Red Lion 700 Series managed switch (HMS Networks / Red Lion Controls) lets an attacker boot the dev
Exploit-DB