700 Series
Monthly
Remote attackers holding low-privilege credentials can crash and reboot Red Lion Controls 700 Series switches by requesting a specific URL on the device's embedded management web server, and because the trigger is a single HTTP request the cycle can be looped with a tool such as curl to hold the switch in continuous reboot (persistent denial of service). The vulnerability is a reachable-assertion flaw (CWE-617) in the web server and is remotely exploitable without user interaction, but requires network reachability to the management interface and, per the assessed CVSS vector (PR:L), a valid low-privilege session; no public exploit code has been identified at time of analysis and no CISA KEV listing is associated with this CVE. Availability impact is high while confidentiality impact is nil, so the practical risk is loss of network switching, management access, and OT/ICS process connectivity rather than data theft.
Firmware and bootloader updates on Red Lion Controls' N-Tron 700 Series industrial Ethernet switches can be pushed or pulled without authentication or image integrity checks, so an attacker running the standard N-Tron management software can scan an OT network over SNMP and TFTP and load arbitrary firmware, taking control of the device image (CWE-494). The published CVSS 4.0 score is 8.4, while the assessed CVSS 3.1 vector (network, scope-changed, High integrity and availability impact) is more severe; the two vectors also disagree on prerequisites, with the published vector encoding PR:L (some privilege) versus PR:N in our assessment, a conflict to confirm with the vendor. Firmware updates are unauthenticated on the update path per the reported description, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; exploitation still requires routable access to the switch management plane, typically from inside a segmented, non-internet-facing OT/ICS network.
Red Lion Controls 700 Series devices expose SNMP functions that can be used to perform administrative operations - retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades - while the vendor's description states these actions require no authentication at all (CWE-306, missing authentication for a critical function). The issue is rated 9.3 in the published CVSS v4.0 score, and the independent assessment scores it as critical (CVSS 3.1 base AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality and integrity and a scope change from the network service to the device itself; availability is not scored as impacted. No CISA KEV listing or public proof-of-concept is present in the supplied intelligence, so the current status is no public exploit identified at time of analysis. One caveat worth resolving early: the published v4.0 vector carries PR:L (some privilege/credential), which contradicts the description's 'without any authentication' - confirm the exact SNMP access requirement against the vendor advisory before de-prioritizing, because if the description is correct the real-world severity is closer to the independent PR:N assessment.
Weak, reversible encryption of usernames and passwords stored in the configuration file of Red Lion Controls 700 Series devices lets an attacker who holds the documented default credentials read the configuration and recover additional system credentials for reuse elsewhere on the device or network. The affected product line is captured by CPE cpe:2.3:a:red_lion_controls:700_series:*:*:*:*:*:*:*:*, meaning the vendor tracks the issue at the product-line level rather than against a specific firmware build, and the flaw is classified as CWE-257 (storage of passwords in a recoverable format). Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network reachable but requiring the attacker to already possess valid credentials (PR:L), with confidentiality-only impact - which is substantially lower than the CVSS 4.0 base score of 9.3 reported in the source data; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided. Real-world risk therefore concentrates on deployments that retain default credentials and expose the management interface to untrusted networks, and on whether the recovered credentials are reused in a way that grants further access.
Plaintext credential storage in Red Lion Controls' 700 Series industrial devices exposes usernames, passwords, and unchanged factory-default credentials to anyone who can obtain the device configuration file, and at least one retrieval path - an SNMP-initiated TFTP export - is described as requiring no authentication. Administrators can also read the configuration through the CLI or export it via TFTP from the web interface, but those routes presume existing privileged access; the unauthenticated SNMP path is the exception that drives the risk rating. CISA ICS advisory ICSA-26-281-01 documents the issue, and our assessment scores it as a confidentiality-only, remotely reachable information-disclosure flaw (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5 High) rather than the 9.3 the CNA vector implies; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Factory default administrator credentials on Red Lion Controls 700 Series devices remain active and cannot be removed by configuring additional administrator accounts, so an attacker who can reach the device's management interface can log in with administrative privileges on a device that operators believe is fully hardened. The independent assessment rates this as a high-impact, effectively unauthenticated network-reachable issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), acknowledging that the supplied CVSS 4.0 vector marks PR:H while the defining feature - publicly known default credentials - means no legitimate account or privilege is required in practice. The practical limiting factor is reachability: ICS/OT networks are often segmented, so real-world exposure depends on whether the management interface is accessible from an attacker-controlled segment; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor fix version is disclosed in the available data.
Physical access to a Red Lion 700 Series managed switch (HMS Networks / Red Lion Controls) lets an attacker boot the device from factory settings without authentication, log in with the default administrative credentials, and then save configuration changes so they survive the next normal reboot. The result is a persistent administrative compromise of the switch: confidentiality impact is limited, but integrity impact is high because routing, VLAN, and access-control configurations can be altered at will. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, and the practical risk is strongly constrained because the attack requires hands-on access to the hardware (CVSS AV:P) and the default credentials must still be valid on first factory boot.
Remote attackers holding low-privilege credentials can crash and reboot Red Lion Controls 700 Series switches by requesting a specific URL on the device's embedded management web server, and because the trigger is a single HTTP request the cycle can be looped with a tool such as curl to hold the switch in continuous reboot (persistent denial of service). The vulnerability is a reachable-assertion flaw (CWE-617) in the web server and is remotely exploitable without user interaction, but requires network reachability to the management interface and, per the assessed CVSS vector (PR:L), a valid low-privilege session; no public exploit code has been identified at time of analysis and no CISA KEV listing is associated with this CVE. Availability impact is high while confidentiality impact is nil, so the practical risk is loss of network switching, management access, and OT/ICS process connectivity rather than data theft.
Firmware and bootloader updates on Red Lion Controls' N-Tron 700 Series industrial Ethernet switches can be pushed or pulled without authentication or image integrity checks, so an attacker running the standard N-Tron management software can scan an OT network over SNMP and TFTP and load arbitrary firmware, taking control of the device image (CWE-494). The published CVSS 4.0 score is 8.4, while the assessed CVSS 3.1 vector (network, scope-changed, High integrity and availability impact) is more severe; the two vectors also disagree on prerequisites, with the published vector encoding PR:L (some privilege) versus PR:N in our assessment, a conflict to confirm with the vendor. Firmware updates are unauthenticated on the update path per the reported description, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; exploitation still requires routable access to the switch management plane, typically from inside a segmented, non-internet-facing OT/ICS network.
Red Lion Controls 700 Series devices expose SNMP functions that can be used to perform administrative operations - retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades - while the vendor's description states these actions require no authentication at all (CWE-306, missing authentication for a critical function). The issue is rated 9.3 in the published CVSS v4.0 score, and the independent assessment scores it as critical (CVSS 3.1 base AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality and integrity and a scope change from the network service to the device itself; availability is not scored as impacted. No CISA KEV listing or public proof-of-concept is present in the supplied intelligence, so the current status is no public exploit identified at time of analysis. One caveat worth resolving early: the published v4.0 vector carries PR:L (some privilege/credential), which contradicts the description's 'without any authentication' - confirm the exact SNMP access requirement against the vendor advisory before de-prioritizing, because if the description is correct the real-world severity is closer to the independent PR:N assessment.
Weak, reversible encryption of usernames and passwords stored in the configuration file of Red Lion Controls 700 Series devices lets an attacker who holds the documented default credentials read the configuration and recover additional system credentials for reuse elsewhere on the device or network. The affected product line is captured by CPE cpe:2.3:a:red_lion_controls:700_series:*:*:*:*:*:*:*:*, meaning the vendor tracks the issue at the product-line level rather than against a specific firmware build, and the flaw is classified as CWE-257 (storage of passwords in a recoverable format). Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network reachable but requiring the attacker to already possess valid credentials (PR:L), with confidentiality-only impact - which is substantially lower than the CVSS 4.0 base score of 9.3 reported in the source data; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided. Real-world risk therefore concentrates on deployments that retain default credentials and expose the management interface to untrusted networks, and on whether the recovered credentials are reused in a way that grants further access.
Plaintext credential storage in Red Lion Controls' 700 Series industrial devices exposes usernames, passwords, and unchanged factory-default credentials to anyone who can obtain the device configuration file, and at least one retrieval path - an SNMP-initiated TFTP export - is described as requiring no authentication. Administrators can also read the configuration through the CLI or export it via TFTP from the web interface, but those routes presume existing privileged access; the unauthenticated SNMP path is the exception that drives the risk rating. CISA ICS advisory ICSA-26-281-01 documents the issue, and our assessment scores it as a confidentiality-only, remotely reachable information-disclosure flaw (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5 High) rather than the 9.3 the CNA vector implies; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Factory default administrator credentials on Red Lion Controls 700 Series devices remain active and cannot be removed by configuring additional administrator accounts, so an attacker who can reach the device's management interface can log in with administrative privileges on a device that operators believe is fully hardened. The independent assessment rates this as a high-impact, effectively unauthenticated network-reachable issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), acknowledging that the supplied CVSS 4.0 vector marks PR:H while the defining feature - publicly known default credentials - means no legitimate account or privilege is required in practice. The practical limiting factor is reachability: ICS/OT networks are often segmented, so real-world exposure depends on whether the management interface is accessible from an attacker-controlled segment; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor fix version is disclosed in the available data.
Physical access to a Red Lion 700 Series managed switch (HMS Networks / Red Lion Controls) lets an attacker boot the device from factory settings without authentication, log in with the default administrative credentials, and then save configuration changes so they survive the next normal reboot. The result is a persistent administrative compromise of the switch: confidentiality impact is limited, but integrity impact is high because routing, VLAN, and access-control configurations can be altered at will. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, and the practical risk is strongly constrained because the attack requires hands-on access to the hardware (CVSS AV:P) and the default credentials must still be valid on first factory boot.