Is CVE-2026-28745 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28745 being exploited in the wild.

How severe is CVE-2026-28745?

High severity, with a CVSS score of 7.5, published 9 October 2026.

Which products and versions are affected?

Red Lion Controls N-Tron 700 Series Firmware ≤3.11.0, Bootloader ≤2.0.6.1.

How is CVE-2026-28745 attacked?

It is attacked with local access or from the adjacent network.

Am I affected by CVE-2026-28745?

Check whether you run Red Lion Controls N-Tron 700 Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28745: Red Lion Controls N-Tron 700 Series weak credential encryption

CVE-2026-28745 · Severity: high · CVSS 7.5 · Published 2026-10-09

Red Lion Controls N-Tron 700 Series is a network switch used in critical infrastructure including manufacturing and communications. This vulnerability allows an attacker with knowledge of default credentials to decrypt and obtain administrator passwords stored in the device's configuration file using weak encryption, potentially leading to full device compromise and control of network traffic.

Technologies: Red Lion Controls N-Tron 700 Series. Vendors: Red Lion Controls.

Quick answers

Is CVE-2026-28745 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28745 being exploited in the wild.
How severe is CVE-2026-28745?: High severity, with a CVSS score of 7.5, published 9 October 2026.
Which products and versions are affected?: Red Lion Controls N-Tron 700 Series Firmware ≤3.11.0, Bootloader ≤2.0.6.1.
Is there a fix for CVE-2026-28745?: Yes: fixed in N-Tron 700 Series Firmware 3.11.1 or greater. Until then: Disable access to the web GUI and configure or disable SNMP communities to restrict paths to credential extraction until the device can be upgraded.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28745 attacked?: It is attacked with local access or from the adjacent network.
Am I affected by CVE-2026-28745?: Check whether you run Red Lion Controls N-Tron 700 Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: N-Tron 700 Series Firmware 3.11.1 or greater

Disable access to the web GUI and configure or disable SNMP communities to restrict paths to credential extraction until the device can be upgraded.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"}]

Technical details

Credentials including default factory credentials are stored in the configuration file using weak encryption (CWE-798). An attacker with initial access via default credentials or through configuration file export can decrypt stored passwords to gain full administrative control. The configuration can be accessed through the web interface, CLI, or via unauthenticated TFTP transfer initiated through SNMP, requiring only local or adjacent network access.

Affected products

Red Lion Controls N-Tron 700 Series Firmware ≤3.11.0, Bootloader ≤2.0.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.