CVE-2026-33367: Red Lion Controls N-Tron 700 Series SNMP unauthenticated administrative access

CVE-2026-33367 · Severity: high · CVSS 8.1 · Published 2026-10-09

The N-Tron 700 Series is an industrial network switch used in critical infrastructure across manufacturing, communications, and energy sectors. An attacker can use SNMP protocol to perform administrative functions—including retrieving sensitive configuration files, modifying user accounts, changing device settings, and triggering firmware downgrades—without providing any credentials. This allows complete compromise of the device and potentially the networks it connects.

Technologies: Red Lion Controls N-Tron 700 Series. Vendors: Red Lion Controls.

Quick answers

Is CVE-2026-33367 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33367 being exploited in the wild.
How severe is CVE-2026-33367?
High severity, with a CVSS score of 8.1, published 9 October 2026.
Which products and versions are affected?
Red Lion Controls N-Tron 700 Series Firmware <=3.11.0, Bootloader <=2.0.6.1.
Is there a fix for CVE-2026-33367?
Yes: fixed in N-Tron 700 Series Firmware 3.11.1 or greater. Until then: Configure or disable SNMP communities on affected devices. Additionally, disable web GUI access to limit attack surface until firmware can be upgraded. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33367 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33367?
Check whether you run Red Lion Controls N-Tron 700 Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: N-Tron 700 Series Firmware 3.11.1 or greater

Configure or disable SNMP communities on affected devices. Additionally, disable web GUI access to limit attack surface until firmware can be upgraded.

Technical details

CVE-2026-33367 allows unauthenticated SNMP access to initiate administrative actions such as configuration export, user account modification, and firmware/bootloader downgrade without authentication. The vulnerability exists in the SNMP implementation which fails to enforce access controls on critical management operations. An attacker on the network can directly exploit this via SNMP protocol to gain full administrative capability over the affected device.

Affected products

  • Red Lion Controls N-Tron 700 Series Firmware <=3.11.0, Bootloader <=2.0.6.1

Timeline

  • 2026-10-09: disclosed
  • 2026-10-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.