Red Lion 700 CVE-2026-39453

Exploitation requires network reachability to the Red Lion 700 Series switch's embedded web server (management interface) and, per the CVSS vector (PR:L), a low-privilege authenticated session; the attacker then navigates to a specific URL that triggers a reachable assertion and reboots the device, which can be looped with curl for sustained DoS. Limiting factors: the management web interface must be network-accessible to the attacker (segmentation or ACLs restricting management-plane access sharply reduce exposure), and valid low-level credentials are required since the vector is PR:L rather than PR:N. No specific non-default feature toggle is named in the description beyond the vulnerable web endpoint itself.

Signals are moderately strong but partly conflicting. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low-level authentication, and scores 8.5 (High). However, the description describes a pure reboot/denial-of-service condition (CWE-617, reachable assertion), which does NOT match the input vector's confidentiality/integrity impacts (VC:L/VI:H/SI:H) - a reboot loop affects availability, not integrity or disclosure, so the input's VI:H/SI:H appear inflated and should be verified against the HMS/CISA advisory. No EPSS score, no CISA KEV listing, and no POC were provided; exploitation status is therefore 'no public exploit identified at time of analysis.' Despite the absence of exploitation signals, the attack is trivially automatable (the description explicitly notes it can be scripted with curl), so a low-privilege attacker with network access to the management web interface could cause sustained outages. Net assessment: a credible availability risk for exposed OT/ICS switches, but the headline 8.5 overstates impact because the real effect is DoS, not data compromise - prioritize based on management-plane exposure rather than the raw score.

An attacker with network access and low-privilege credentials to a Red Lion 700 Series switch's web management interface repeatedly requests a specific crafted URL that triggers a reachable assertion, forcing the switch to reboot. By scripting the request in a loop with curl, the attacker keeps the switch in a continuous reboot cycle, disrupting the network segment it serves. No public exploit code was identified, but the technique is explicitly described as trivially automatable.