Seven Critical Vulnerabilities Discovered in Red Lion Controls N-Tron 700 Series Industrial Switches

The Cybersecurity and Infrastructure Security Agency (CISA) has issued advisory ICSA-26-281-01 detailing seven vulnerabilities in Red Lion Controls N-Tron 700 Series industrial switches. The vulnerabilities affect firmware versions up to and including 3.11.0 and bootloader versions up to and including 2.0.6.1.

The seven CVEs identified are CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, and CVE-2026-33272. Vulnerability types include use of hard-coded credentials, insufficiently protected credentials, storing passwords in a recoverable format, missing authentication for critical functions, download of code without integrity check, reachable assertion, and authentication bypass using an alternate path or channel.

The impact of successful exploitation varies. Some flaws allow a malicious user to gain administrative access to the device, enabling them to view, edit, and upload configuration files. Other vulnerabilities allow an attacker to cause the switch to reboot by navigating to a specific URL; this action can be scripted on a local machine to induce continuous rebooting, potentially denying service to industrial operations. Additionally, usernames and passwords including default factory credentials are stored in plaintext within configuration files, accessible via the CLI or through TFTP transfers initiated via SNMP without authentication.

CVSS scores range from 3.1 (MEDIUM) to 9.2 (CRITICAL), with attack vectors primarily local or adjacent, low complexity, and some requiring administrator rights or SNMP privileges. A common theme across the vulnerabilities is CWE-798 (Use of Hard-coded Credentials).

Red Lion Controls, headquartered in Sweden, notes that the affected equipment spans critical infrastructure sectors including Commercial Facilities, Communications, Critical Manufacturing, and Information Technology, with worldwide deployment.

The vendor recommends upgrading to firmware version 3.11.1 or greater as the primary remediation. Additional mitigations include configuring or disabling SNMP communities, disabling access to the web GUI, and reviewing the vendor's upgrade procedure document.