CVE-2026-29797 (GCVE-0-2026-29797)
Vulnerability from cvelistv5
Published
2026-10-09 14:40
Modified
2026-10-11 17:05
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
8.4 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
CWE
Summary
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.
References
Impacted products
Vendor Product Version
Red Lion Controls 700 Series Version: 0   < Firmware Versions 3.11.0
Version: 0   < Bootloader Versions 2.0.6.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:49:35.238324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T17:05:28.589Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "700 Series",
          "vendor": "Red Lion Controls",
          "versions": [
            {
              "lessThan": "Firmware Versions 3.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Bootloader Versions 2.0.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "3.11.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gabrianna (Ria) Milloway of Idaho National Laboratory reported this vulnerability to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP."
            }
          ],
          "value": "No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-494",
              "description": "CWE-494",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T14:40:20.991Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.hms-networks.com/"
        },
        {
          "url": "https://www.hms-networks.com/cybersecurity"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRed Lion controls recommends the following upgrades for the N-Tron 700 Series: \u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eUpgrade to firmware version 3.11.1 or greater\u003c/li\u003e\u003cli\u003eConfigure or disable the SNMP communities\u003c/li\u003e\u003cli\u003eDisable access to the web GUI\u003c/li\u003e\u003c/ul\u003e\n\u003cp\u003eThe upgrade procedure document can be viewed \u003ca href=\"https://www.hms-networks.com/\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThe advisory issued by HMS Networks regarding these vulnerabilities can be viewed \u003ca href=\"https://www.hms-networks.com/cybersecurity\"\u003ehere\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Red Lion controls recommends the following upgrades for the N-Tron 700 Series: \n\n\n  *  Upgrade to firmware version 3.11.1 or greater\n  *  Configure or disable the SNMP communities\n  *  Disable access to the web GUI\n\n\n\n\n\nThe upgrade procedure document can be viewed  here https://www.hms-networks.com/ .\n\n\n\n\nThe advisory issued by HMS Networks regarding these vulnerabilities can be viewed  here https://www.hms-networks.com/cybersecurity ."
        }
      ],
      "source": {
        "advisory": "ICSA-26-281-01",
        "discovery": "EXTERNAL"
      },
      "title": "Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2026-29797",
    "datePublished": "2026-10-09T14:40:20.991Z",
    "dateReserved": "2026-04-08T19:28:49.509Z",
    "dateUpdated": "2026-10-11T17:05:28.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-29797\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-11T16:49:35.238324Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-11T16:55:33.434Z\"}}], \"cna\": {\"title\": \"Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check\", \"source\": {\"advisory\": \"ICSA-26-281-01\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Gabrianna (Ria) Milloway of Idaho National Laboratory reported this vulnerability to CISA.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.4, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Red Lion Controls\", \"product\": \"700 Series\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Firmware Versions 3.11.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Bootloader Versions 2.0.6.1\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"3.11.1\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Red Lion controls recommends the following upgrades for the N-Tron 700 Series: \\n\\n\\n  *  Upgrade to firmware version 3.11.1 or greater\\n  *  Configure or disable the SNMP communities\\n  *  Disable access to the web GUI\\n\\n\\n\\n\\n\\nThe upgrade procedure document can be viewed  here https://www.hms-networks.com/ .\\n\\n\\n\\n\\nThe advisory issued by HMS Networks regarding these vulnerabilities can be viewed  here https://www.hms-networks.com/cybersecurity .\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eRed Lion controls recommends the following upgrades for the N-Tron 700 Series: \u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eUpgrade to firmware version 3.11.1 or greater\u003c/li\u003e\u003cli\u003eConfigure or disable the SNMP communities\u003c/li\u003e\u003cli\u003eDisable access to the web GUI\u003c/li\u003e\u003c/ul\u003e\\n\u003cp\u003eThe upgrade procedure document can be viewed \u003ca href=\\\"https://www.hms-networks.com/\\\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\\n\u003cp\u003eThe advisory issued by HMS Networks regarding these vulnerabilities can be viewed \u003ca href=\\\"https://www.hms-networks.com/cybersecurity\\\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.hms-networks.com/\"}, {\"url\": \"https://www.hms-networks.com/cybersecurity\"}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01\"}, {\"url\": \"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-494\", \"description\": \"CWE-494\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2026-10-09T14:40:20.991Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-29797\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-11T17:05:28.589Z\", \"dateReserved\": \"2026-04-08T19:28:49.509Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2026-10-09T14:40:20.991Z\", \"assignerShortName\": \"icscert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.