CVE-2026-33367: Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Lion Controls N-Tron 700 Seriesto a version that resolves this vulnerability.Fixed in 3.11.1 - Configuration
Configure or disable the SNMP communities to prevent unauthenticated administrative actions.
Red Lion Controls N-Tron 700 Series SNMP communities = configured or disabled - Configuration
Disable access to the web GUI.
Red Lion Controls N-Tron 700 Series web GUI web GUI access = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker with network access to the device's SNMP service can perform the affected administrative actions. The supplied vector indicates that exploitation requires low privileges and no user interaction.
Is authentication required to make administrative changes through SNMP?
No. SNMP administrative functions can be used without authentication, including modifying user accounts and device settings, retrieving configuration files, and initiating firmware or bootloader upgrades or downgrades.
What can be done if patching is not immediately possible?
The provided information does not identify a vendor patch or workaround. Because exploitation depends on access to SNMP, restrict network access to the device's SNMP service to trusted administrative systems where possible.