N-Tron 700 Series CVE-2026-29797

Exploitation requires network reachability to an N-Tron 700 Series switch's management plane with SNMP and TFTP firmware-transfer functionality accessible - typically from within an OT/ICS network segment. The specific enabling condition is the device's firmware/bootloader update path, which performs no authentication and no integrity/signature validation on uploaded images, so an attacker using the standard N-Tron management software can scan for devices and push or pull firmware directly. Limiting factors: exploitation depends on the attacker already having routable access to the (usually segmented and non-internet-facing) industrial network, and the official CVSS vector encodes PR:L, implying some privilege may be required - this conflicts with the description and should be confirmed with the vendor. No user interaction is needed.

This is a genuine operational-technology (OT) priority within its deployment niche, though the signals partially conflict. The official CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.4 (High) with network attack vector, low complexity, no attack requirements, and no user interaction - all of which favor the attacker. However, there is a direct contradiction between the vector and the description: the vector encodes PR:L (some privilege/authentication required), while the description states twice that 'No authentication is required' and that firmware can be pushed/pulled 'without authenticating' via SNMP/TFTP. This discrepancy should be verified with the vendor (HMS Networks/Red Lion); if the description is accurate, the true privilege requirement is PR:N and real-world risk is higher than the vector implies. Impact is integrity-dominant (VI:H / SI:H, CWE-494 Download of Code Without Integrity Check): an attacker can overwrite firmware or bootloader with unsigned/malicious images, giving persistent control of the switch. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation - this is a high-severity-by-design-flaw case rather than a confirmed in-the-wild threat. The low real-world mitigant is prevalence: N-Tron 700 Series are industrial Ethernet switches with a limited, OT-specific footprint, not ubiquitous enterprise software.

An attacker with network reachability to an N-Tron 700 Series switch (e.g., a foothold on the OT/ICS network segment) uses the vendor's own management software to scan for N-Tron devices and then pushes a malicious firmware or bootloader image over SNMP/TFTP without supplying credentials. Because there is no integrity check (CWE-494), the device accepts and runs the tampered image, handing the attacker persistent control of a network switch. No public exploit code is identified at time of analysis, but the attack reportedly requires only the standard management software.