CISA flags seven flaws in Red Lion N-Tron 700 switches, including hard-coded credentials

CISA has updated its advisory on Red Lion Controls N-Tron 700 Series industrial switches, detailing seven vulnerabilities that range from default factory credentials to unauthenticated firmware uploads and a scriptable reboot loop. The devices are deployed worldwide across commercial facilities, communications, critical manufacturing and IT sectors. This segment sets out what is affected, the remediation path, and where the operational risk concentrates.

• Affected versions are N-Tron 700 Series firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier; Red Lion recommends upgrading to version 3.11.1 or greater.
• CVE-2026-32645 concerns default factory administrative credentials that persist even after other administrator accounts are configured.
• CVE-2026-33367 allows SNMP to retrieve configuration files, modify accounts and settings, and initiate firmware or bootloader changes without any authentication.
• CVE-2026-28745, scored CVSS v4 9.3 (critical), involves passwords stored in the configuration file using weak encryption.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it at this time.

Executive summary

CISA revised advisory ICSA-26-281-01 on 15 October 2026, updating CVSS v4.0 scores and fixing broken links following initial publication on 8 October 2026. The advisory identifies seven vulnerabilities in Red Lion Controls N-Tron 700 Series switches, affecting firmware versions up…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.