Red Lion 700 Series CVE-2026-32645

Exploitation requires access to the administrative/management interface of a Red Lion Controls 700 Series device and use of the factory default administrator credentials; critically, these default credentials remain enabled and cannot be eliminated by creating other administrator accounts, so even hardened-looking deployments stay vulnerable. No non-default configuration is needed - the condition is present out of the box. The primary LIMITING factor is reachability of the device's management interface: ICS/OT networks are frequently segmented, so realistic exposure depends on whether the interface is accessible from an attacker-controlled network segment. Note the input CVSS marks PR:H, but the defining feature is publicly/known default credentials, which practically require no legitimate privileges.

This is a genuine high-priority defect for the environments where Red Lion Controls 700 Series devices are deployed, driven by the nature of the flaw rather than hype: CWE-798 (hard-coded/default factory credentials with administrative access) that persist even after new administrator accounts are configured, meaning operators who believe they have secured the device remain fully exposed. The vulnerability is confirmed via a CISA ICS advisory (icsa-26-281-01) and vendor material (HMS Networks/Red Lion). There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no public exploit identified at time of analysis - exploitation is not confirmed in the wild. SIGNAL CONFLICT TO VERIFY: the supplied CVSS 4.0 vector is AV:L/AC:L/PR:H (local access, high privileges required) yet the vulnerability is the existence of publicly-known default admin credentials, which by definition requires no prior authorization and is typically reachable over a management interface - the PR:H and AV:L choices appear inconsistent with a default-credential weakness and should be verified with the vendor/ICS-CERT. If the management interface is network-reachable, real-world risk is materially higher than the local-vector score implies. No SSVC decision data was provided. Net: a real, actionable issue (standing admin backdoor) but exploitation likelihood in a given environment depends heavily on network exposure and segmentation of the OT device.

An attacker who can reach the management interface of a Red Lion 700 Series device logs in using the undocumented/known factory default administrator credentials, which remain active regardless of any additional admin accounts the operator created. With full administrative control the attacker reconfigures the device, reads sensitive configuration, and manipulates the connected OT process. No public exploit code is required - the attack is simply authenticating with the persistent default credentials.