OTPulse

Red Lion Controls N-Tron 700 Series

Plan PatchCVSS 8.3ICS-CERT ICSA-26-281-01Oct 8, 2026
Red Lion
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Red Lion N-Tron 700 Series switches contain multiple vulnerabilities in authentication, credential storage, and access control. An attacker with user-level credentials can access the device's web interface to view and modify configuration files. Additionally, the device is vulnerable to unauthenticated denial-of-service attacks via a specific URL that triggers continuous reboots. SNMP communities, if not properly secured, may allow unauthorized device access. These vulnerabilities affect firmware versions 3.11.0 and earlier, and bootloader versions 2.0.6.1 and earlier.

What this means
What could happen
An attacker with login credentials could gain administrative access to the N-Tron 700 Series switch, allowing them to modify network configuration files and view sensitive data. Additionally, they could trigger continuous device reboots, interrupting network connectivity and communications to connected sensors, PLCs, and field devices.
Who's at risk
Water utilities and electric cooperatives using Red Lion N-Tron 700 Series managed industrial Ethernet switches for SCADA network connectivity and field device communication should prioritize assessment. These switches typically connect PLCs, RTUs, sensors, and HMIs to central control systems.
How it could be exploited
An attacker with valid user credentials can authenticate to the device's web interface and access administrative functions. They can then upload malicious configuration files or repeatedly navigate to a reboot URL to cause denial of service. If SNMP communities are not properly configured, an attacker may also enumerate or modify device settings via SNMP.
Prerequisites
  • Valid user credentials for the N-Tron 700 web interface
  • Network access to the device's web GUI or management interface
  • Knowledge of the reboot URL or SNMP community strings if SNMP is enabled
Remotely exploitableRequires valid credentialsLow attack complexityNo authentication required for some functions (e.g., URL-based reboot)Affects network availability
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
700 Series≤ Firmware 3.11.0Fix available
700 Series≤ Bootloader 2.0.6.1Fix available
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDDisable or restrict access to the web GUI to authorized management networks only
WORKAROUNDConfigure or disable SNMP communities to prevent unauthorized device discovery and configuration changes
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

700 Series
HOTFIXUpgrade N-Tron 700 Series firmware to version 3.11.1 or greater
HOTFIXUpgrade N-Tron 700 Series bootloader to version 2.0.6.2 or greater
View full CISA ICS-CERT advisory
API: /api/v1/advisories/b7a9b527-04c7-4ee5-9925-747cd253cf6d

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.