CVE-2026-32645 PUBLISHED

Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials

Assigner: icscert
Reserved: 08.04.2026 Published: 09.10.2026 Updated: 09.10.2026

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 6

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	High
User Interaction	None

CVSS 4.0

Vendor	Red Lion Controls
Product	700 Series
Versions	Default: unaffected affected from 0 to Firmware Versions 3.11.0 (excl.) affected from 0 to Bootloader Versions 2.0.6.1 (excl.) Version 3.11.1 is unaffected

Red Lion controls recommends the following upgrades for the N-Tron 700 Series:

The upgrade procedure document can be viewed here https://www.hms-networks.com/ .

The advisory issued by HMS Networks regarding these vulnerabilities can be viewed here https://www.hms-networks.com/cybersecurity .

Gabrianna (Ria) Milloway of Idaho National Laboratory reported this vulnerability to CISA. finder