Overview
CISA published advisory ICSA-26-281-01 on 8 October 2026 for the Red Lion Controls N-Tron 700 Series, a line of industrial Ethernet switches. CISA revised it as Update A on 15 October, changing the CVSS v4.0 scores and fixing broken links. The advisory covers seven vulnerabilities. The research is credited to Gabrianna (Ria) Milloway of Idaho National Laboratory. CISA states it knows of no public exploitation.
Switches sit at a sensitive point in an OT network. They carry traffic between PLCs, HMIs and gateways, and a switch you can configure is a switch you can use to disrupt, mirror or reroute traffic. The common thread across these flaws is that the management plane, especially SNMP and TFTP, trusts the caller too easily.
Affected versions and fix
- Firmware: 700 Series version 3.11.0 and earlier.
- Bootloader: version 2.0.6.1 and earlier.
- Vendor fix: upgrade to firmware 3.11.1 or later. Red Lion also recommends configuring or disabling SNMP communities and disabling web GUI access.
The seven vulnerabilities
| CVE | CWE | Issue | CVSS v3.1 | CVSS v4.0 |
|---|---|---|---|---|
| CVE-2026-32645 | CWE-798 | Default factory admin credentials stay active after other admin accounts are configured | 6.0 | 8.3 |
| CVE-2026-39460 | CWE-522 | Credentials stored in plaintext in the config file; a TFTP export can be triggered over SNMP without authentication | 8.1 | 8.6 |
| CVE-2026-28745 | CWE-257 | Weak, recoverable credential storage; known default credentials can expose others | 7.5 | 9.3 |
| CVE-2026-33367 | CWE-306 | SNMP allows unauthenticated admin actions: retrieve configs, change accounts and settings, upgrade or downgrade firmware or bootloader | 8.1 | 8.6 |
| CVE-2026-29797 | CWE-494 | Firmware and bootloader updates need no authentication, so malicious files can be pushed; devices can be found and updated via SNMP/TFTP | 7.1 | 7.1 |
| CVE-2026-39453 | CWE-617 | A specific web server URL reboots the switch; scripting it allows continuous denial of service | 8.3 | 7.2 |
| CVE-2026-33272 | CWE-288 | With physical access, booting from factory settings exposes default admin credentials and changes persist | 4.9 | 5.2 |
The highest v3.1 score in the advisory is 8.3. Under v4.0, CVE-2026-28745 is rated Critical at 9.3. We have not independently scored these.
How the flaws combine
Individually several of these look moderate. Together they describe a short path, which is our analysis rather than an observed attack:
- Reach the SNMP service. Per CVE-2026-33367, SNMP lets an unauthenticated caller retrieve the configuration and change accounts and settings.
- Harvest credentials. Per CVE-2026-39460, the config file stores usernames and passwords in plaintext, and TFTP export can be triggered over SNMP without authentication. CVE-2026-28745 says known default credentials can expose others.
- Take control or persist. Per CVE-2026-29797, firmware and bootloader updates need no authentication, so a device can be given a malicious image. Per CVE-2026-33367 it can also be downgraded.
- Disrupt. Per CVE-2026-39453, repeated requests to one URL reboot the switch, which on a plant network means repeated loss of communications.
The firmware update flaw is the most serious operationally. A switch image replaced by an attacker survives reboots and is hard to detect without hash verification against a known-good image.
Operational impact
CISA lists the sectors as Commercial Facilities, Communications, Critical Manufacturing and Information Technology, with deployment worldwide. On a flat plant floor, an attacker on the control network could change the switch configuration, which in practice could mean port mirroring, VLAN changes or disabling ports. The advisory text states the confirmed impacts: administrative access, viewing and editing configuration files, uploading configuration, rebooting the switch and pushing firmware. Specific consequences for a given site depend on how the switch is deployed, and we are not aware of any observed incident.
Mitigation and hardening
- Patch. Upgrade to firmware 3.11.1 or later, following the vendor’s upgrade procedure. Check the bootloader version as well. The advisory links to the vendor procedure and an HMS Networks advisory.
- Reduce the SNMP attack surface. Configure or disable SNMP communities as the vendor advises. Where SNMP is needed, restrict it to the management station’s address with an ACL on an upstream device.
- Disable the web GUI if you do not use it.
- Change default credentials and verify, since the default admin remains active per CVE-2026-32645 even after other accounts are configured. Confirm that the default login no longer works.
- Segment. Follow CISA’s guidance: minimise network exposure, keep control networks behind firewalls and separate from business networks, and use updated VPNs for remote access. Management traffic should sit on a dedicated VLAN.
- Block TFTP and SNMP from untrusted zones at the conduit firewall.
- Protect physical access. CVE-2026-33272 needs physical access, so lock cabinets and consider port security on adjacent equipment.
Detection ideas
These are our suggestions, not advisory guidance.
- Passive monitoring of the management plane. Alert on SNMP set requests, and on TFTP transfers involving a switch, from any source other than the approved management host.
- Config and firmware baselines. Take a hash of the running configuration and firmware version on a schedule and alert on drift. An unexpected firmware downgrade is a strong signal.
- Reboot telemetry. Repeated switch reboots or uptime resets, especially with web server requests in the preceding minutes, match CVE-2026-39453.
- Inventory. Many plants do not know which switches run which firmware. Use this advisory to find out.
Timeline
| Date | Event |
|---|---|
| 8 October 2026 | CISA publishes ICSA-26-281-01 |
| 15 October 2026 | Update A: CVSS v4.0 scores updated, broken links fixed |
Source
- CISA ICS Advisory ICSA-26-281-01, Red Lion Controls N-Tron 700 Series (Update A): https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01