Factory Credentials That Survive Reconfiguration on Red Lion Switches
Seven flaws in the N-Tron 700 Series, four critical on CVSS v4.0: hard-coded admin credentials that persist after new accounts are created, plaintext passwords retrievable over unauthenticated SNMP, and unsigned firmware updates.
CISA released ICSA-26-281-01 on 8 October for Red Lion Controls N-Tron 700 Series managed industrial Ethernet switches, firmware 3.11.0 and earlier with bootloader 2.0.6.1 and earlier. Seven CVEs, four of them critical on CVSS v4.0.
The one that undoes a commissioning checklist is CVE-2026-32645, scored 6.0 on v3.1 and 9.2 on v4.0: default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. An engineer who followed the hardening procedure, created a named admin and deleted nothing still has a switch with factory access.
Three more sit at 9.3 on v4.0. CVE-2026-39460 exposes plaintext credentials in configuration files, retrievable over CLI or a TFTP transfer initiated through unauthenticated SNMP. CVE-2026-28745 covers weakly encrypted stored passwords. CVE-2026-33367 is missing authentication on SNMP administrative actions outright.
Then the integrity problems. CVE-2026-29797, at 8.4 on v4.0, allows firmware or bootloader updates with no authentication — unsigned code onto a switch, remotely. CVE-2026-39453, at 8.5, reboots the switch when a certain URL on its web server is requested. CVE-2026-33272 permits booting from factory settings without authentication, but needs physical access.
Red Lion's remediation is firmware 3.11.1 or later, with SNMP community reconfiguration or disablement and web GUI lockdown as interim mitigations. Gabrianna Milloway of Idaho National Laboratory reported the set. Listed sectors are commercial facilities, communications, critical manufacturing and information technology.
These switches sit at the cell and machine layer, which is below where most IT monitoring looks. Unauthenticated SNMP administration plus unsigned firmware is a persistent foothold in exactly the part of the network nobody inventories, and the persistence of factory credentials means the usual answer — "we changed the default password" — was never true.