Red Lion 700 CVE-2026-39460

Exploitation requires network access to a Red Lion 700 Series device's management interfaces. The credential-disclosure payload is the device configuration file, which stores usernames/passwords (and unchanged factory-default credentials) in plaintext. Three documented retrieval paths exist with differing prerequisites: (1) viewing the config via CLI, which requires administrator rights; (2) exporting the config via TFTP from the web interface, which requires administrator access; and (3) initiating the TFTP config export through SNMP, which per the description does NOT require authentication - this is the key limiting-factor exception that elevates risk. Limiting factors: the SNMP path depends on the SNMP service being reachable and its write/community configuration permitting the TFTP action; the CLI/web paths are constrained to already-privileged users; and typical OT network segmentation limits remote reachability. Impact is magnified where factory-default credentials remain unchanged.

This is a genuine high-priority issue for affected ICS operators rather than an inflated CVSS score, primarily because of the unauthenticated access path, not the plaintext storage alone. The authoritative CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:L/UI:N) rates it near-critical with network reach and low complexity, and critically the subsequent-system impacts (SC:H/SI:H) reflect that disclosed admin credentials - including factory defaults - enable full downstream device compromise. The most important signal is in the description itself and partially conflicts with the headline vector: while PR:L implies authentication is required, the description explicitly states that a TFTP export of the configuration file (which holds the plaintext credentials) can be initiated through SNMP 'which does not require authentication' - this strongly suggests an unauthenticated exploitation path (PR:N) exists that the base vector's PR:L does not capture; verify the SNMP write-community configuration with the vendor. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation yet; the risk is driven by the vulnerability's inherent accessibility and the high value of the target (OT devices), not by observed in-the-wild activity. Mitigating the real-world footprint, Red Lion 700 Series are niche industrial controllers typically deployed on segmented OT networks rather than internet-exposed hosts.

An attacker with network reachability to the device's SNMP interface initiates a TFTP transfer of the configuration file to a server they control, without needing to authenticate, then parses the exported file to recover the plaintext administrator username and password (or unchanged factory defaults). With those credentials the attacker logs in to fully control the controller. No public exploit code is identified at time of analysis.