What’s Vulnerable › Vulnerabilities

CVE-2026-33367: Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-09 · updated 2026-10-11
• Weakness: CWE-306

Description

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

Affected products

• Red Lion Controls 700 Series: before Firmware Versions 3.11.0; before Bootloader Versions 2.0.6.1 — fixed in Bootloader Versions 2.0.6.1, Firmware Versions 3.11.0

How to fix

Upgrade to a fixed version: Red Lion Controls 700 Series Bootloader Versions 2.0.6.1, Firmware Versions 3.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01
• https://www.hms-networks.com/
• https://www.hms-networks.com/cybersecurity

Get alerted when CVE-2026-33367 or the next vulnerability affects your stack