CVE-2026-29797: Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Lion Controls N-Tron 700 Series firmwareto a version that resolves this vulnerability.Fixed in 3.11.1 - Configuration
Configure or disable the SNMP communities.
Red Lion Controls N-Tron 700 Series SNMP communities = configured or disabled - Configuration
Disable access to the web GUI.
Red Lion Controls N-Tron 700 Series Web GUI access = disabled
Event History
Frequently Asked Questions
Which devices and deployments are exposed?
Red Lion Controls N-Tron 700 Series devices are affected where they are reachable over the network for SNMP/TFTP-based firmware or bootloader operations. The issue applies because those update operations do not require authentication.
What does an attacker need to exploit this issue?
An attacker needs network access to the device and the same software used to scan for N-Tron devices and push or pull firmware. No authentication or user interaction is required.
What is the likely impact of successful exploitation?
An attacker can push malicious firmware or bootloader files to the device. This can compromise the integrity of the device software and expose firmware contents through unauthenticated retrieval.