EUVD-2026-95812
GHSA-66jm-5jv9-hhhv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device SNMP service over network
-
DeliverySend unauthenticated SNMP admin request
-
ExploitRetrieve configuration and credentials
-
ExecutionModify accounts or device settings
-
PersistTrigger firmware or bootloader downgrade
-
ImpactPersist control of OT device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the SNMP service on a Red Lion 700 Series device; the described administrative SNMP operations (configuration retrieval, account/setting modification, and firmware/bootloader upgrade or downgrade) are performed with no authentication per the description (CWE-306). Limiting factors: the SNMP interface must be reachable by the attacker (devices segmented behind OT firewalls or with SNMP disabled/filtered are not exposed), and the input CVSS vector's PR:L contradicts the description's 'without any authentication' - if PR:L is accurate, some credential/privilege would be required, so confirm the exact SNMP access requirement against the vendor advisory before de-prioritizing. |
| Impact | This is a high-priority issue for affected operational-technology environments. CWE-306 (Missing Authentication) combined with the CVSS 4.0 vector (AV:N/AC:L/UI:N) describes a network-reachable, low-complexity flaw requiring no user interaction, and the description states administrative SNMP actions are possible 'without any authentication.' There is a direct conflict in the input: the provided CVSS 4.0 vector sets PR:L (implying some privilege) while the description and CWE-306 both indicate NO authentication is required (PR:N) - verify with the vendor/CISA advisory, as this materially changes risk (unauthenticated is worse). High technical impact is confirmed (VC:H/VI:H, SC:H/SI:H), covering configuration disclosure, account/setting modification, and firmware/bootloader changes. However, EPSS probability is NOT provided, this CVE is NOT listed in CISA KEV, and NO public proof-of-concept is referenced - so there is no current signal of active or widespread exploitation. Net: treat as a serious, patch-soon vulnerability in exposed Red Lion 700 Series devices (especially any with SNMP reachable from untrusted networks), while recognizing the real-world exploitation signals (EPSS/KEV/POC) are presently absent and the authentication prerequisite is contradictory in the source data. |
| Exploit ScenarioDerived | An attacker with network reach to a Red Lion 700 Series device's SNMP service sends SNMP requests to read the device configuration and then modify user accounts or device settings, or trigger a firmware/bootloader downgrade. Because the described flaw requires no authentication and low attack complexity (AV:N/AC:L), a single network-positioned actor could fully compromise the device. No public exploit code is referenced in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 09, 2026
Red Lion Controls 700 Series devices expose SNMP functions that can be used to perform administrative operations - retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades - while the vendor's description states these actions require no authentication at all (CWE-306, missing authentication for a critical function). The issue is rated 9.3 in the published CVSS v4.0 score, and the independent assessment scores it as critical (CVSS 3.1 base AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality and integrity and a scope change from the network service to the device itself; availability is not scored as impacted. No CISA KEV listing or public proof-of-concept is present in the supplied intelligence, so the current status is no public exploit identified at time of analysis. One caveat worth resolving early: the published v4.0 vector carries PR:L (some privilege/credential), which contradicts the description's 'without any authentication' - confirm the exact SNMP access requirement against the vendor advisory before de-prioritizing, because if the description is correct the real-world severity is closer to the independent PR:N assessment.
Earlier versions of this analysis (1)
Red Lion Controls (HMS Networks) 700 Series devices expose administrative SNMP functionality - configuration file retrieval, user account and device setting modification, and firmware or bootloader upgrades and downgrades - to network-reachable parties, per ICS-CERT advisory ICSA-26-281-01 (CWE-306, missing authentication for a critical function). The practical risk is highest where SNMP is reachable from an untrusted or flat segment, and the supplied signal set is internally inconsistent: the published CVSS:3.1 vector indicates PR:L (some authentication), while the advisory description and CWE-306 indicate no authentication is required, and the independent assessment scores the issue as unauthenticated remote compromise (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No CISA KEV entry and no public exploit code were provided in the input, so exploitation status is best described as no public exploit identified at time of analysis; no EPSS score was supplied either. Impact is high-integrity/high-availability on OT devices because unauthorized firmware or bootloader changes can render a unit inoperable or place it under attacker control.
RemediationAI
No vendor-released patch identified at time of analysis - the supplied references point to the HMS Networks security pages and CISA ICS advisory ICSA-26-281-01 but do not include a fixed firmware version, so the first action is to consult https://www.hms-networks.com/cybersecurity and the ICS advisory for a patched firmware release and apply it once published. Until a fix is available, apply compensating controls in this order of effectiveness: disable the SNMP service entirely on 700 Series devices where SNMP-based management or monitoring is not required, which fully removes the attack surface but also removes any SNMP telemetry or management integration those devices currently provide; if SNMP must remain enabled, block inbound UDP/161 and UDP/162 (and TCP/161 if the implementation supports SNMP over TCP) at the OT firewall or conduit boundary and permit SNMP only from explicitly allowlisted management station addresses on a dedicated management VLAN, accepting that this breaks management-from-general-IT-networks workflows and requires firewall rule maintenance; and where the SNMP service cannot be disabled or filtered, treat the device as internet- and IT-network-exposed only under strict monitoring, alerting on configuration retrieval, account or settings changes, and firmware or bootloader upgrade/downgrade events so that administrative actions taken through SNMP are visible to operations. Do not assume that enabling SNMPv3 authentication and encryption remediates this issue: CWE-306 describes a missing authentication check on the administrative function itself, so confirm with the vendor whether protocol-level authentication actually closes the bypass. Finally, resolve the PR:L versus PR:N discrepancy noted in the published CVSS v4.0 vector against the vendor advisory - if the vector is accurate, some credential or privilege is a prerequisite and prioritization can be adjusted accordingly, but until that is confirmed, treat the SNMP administrative functions as reachable without authentication. Security teams should also treat the referenced advisory IDs as a tracking anchor for follow-up: once a firmware version is named, validate it against the device's current build before closing the item.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the SNMP management interface on Red Lion Controls 700 Series devices (CPE cpe:2.3:a:red_lion_controls:700_series:*:*:*:*:*:*:*:*), now part of the HMS Networks portfolio following its acquisition of Red Lion Controls. The root cause class is CWE-306, Missing Authentication for Critical Function: the SNMP agent path that exposes administrative capabilities does not enforce an authentication step, so the critical functions reachable through it - configuration file retrieval, user account and device setting modification, and firmware or bootloader upgrade/downgrade initiation - can be driven by whoever can reach the service. Note that the CPE uses a wildcard version, meaning the advisory's CPE does not itself constrain a fixed version range, so all shipping 700 Series firmware should be treated as potentially affected until the vendor advisory enumerates fixed builds. Because the weakness is missing authentication rather than weak credentials or a protocol-version weakness, protocol hardening alone (for example, moving to SNMPv3) should not be assumed to remediate the exposure unless the vendor states that it does. The SNMP service is the entire attack surface here: if it is not reachable, the vulnerability is not exploitable over the network, which makes segmentation and service exposure the decisive control in OT deployments.
Know when 700 Series gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Description states admin SNMP actions occur without authentication so PR:N; network SNMP gives AV:N/AC:L; gateway compromise affects downstream OT (S:C) and firmware/bootloader changes break availability (A:H).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades-all without any authentication.
Executive ViewAI
Red Lion Controls 700 Series industrial devices can be fully taken over through their SNMP service without valid credentials, letting anyone who can reach the device read configuration files, change user accounts and settings, and push or roll back firmware. Because these devices typically sit at the edge of operational technology networks, a compromise could expose network architecture and hand an adversary persistent control over connected industrial equipment. No vendor patch or public exploit has been identified, so near-term risk reduction depends on network isolation rather than patching.
No vendor-released patch identified at time of analysis. Interim mitigations: disable SNMP on the 700 Series devices where it is not required for operations; block UDP 161/162 at network boundaries and on host firewalls; segment affected devices onto an isolated management VLAN with access restricted to allow-listed management hosts; monitor and alert on SNMP write/administrative operations, unauthorized account creation, and unscheduled firmware or bootloader changes; and restrict physical and remote access to the devices until a vendor fix is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in 700 Series
View allPlaintext credential storage in Red Lion Controls' 700 Series industrial devices exposes usernames, passwords, and uncha
Weak, reversible encryption of usernames and passwords stored in the configuration file of Red Lion Controls 700 Series
Remote attackers holding low-privilege credentials can crash and reboot Red Lion Controls 700 Series switches by request
Firmware and bootloader updates on Red Lion Controls' N-Tron 700 Series industrial Ethernet switches can be pushed or pu
Factory default administrator credentials on Red Lion Controls 700 Series devices remain active and cannot be removed by
Physical access to a Red Lion 700 Series managed switch (HMS Networks / Red Lion Controls) lets an attacker boot the dev
Exploit-DB