CISA Warns of Seven Flaws in Red Lion N-Tron Switches Used Across Energy, Manufacturing Sectors

The Cybersecurity and Infrastructure Security Agency issued advisory ICSA-26-281-01 on Oct. 8, 2026, disclosing seven vulnerabilities in Red Lion Controls’ N-Tron 700 Series industrial switches. The flaws affect devices running firmware version 3.11.0 and earlier and bootloader version 2.0.6.1 and earlier. CISA assigned the vulnerability set a CVSS score of 8.3, high severity.

Successful exploitation could give an attacker administrative access to a switch, letting them view, edit and upload configuration files, according to CISA. A separate bug lets an attacker trigger continuous rebooting of the device by repeatedly navigating to a crafted URL, a sequence that can be scripted to cause an automated denial-of-service condition. The underlying weaknesses include hard-coded credentials, passwords stored in a recoverable format and a missing-authentication flaw for a critical function, CISA said.

N-Tron switches route network traffic between controllers, sensors and other equipment inside industrial control systems, the operational technology networks that run physical processes separate from standard office IT. CISA lists Commercial Facilities, Communications, Critical Manufacturing and Information Technology among the affected sectors, with devices deployed worldwide. If an attacker reaches one of these switches and pivots further into a control network, the exposure runs higher than on an ordinary office switch, because compromised network infrastructure sits between the controllers that open valves, run motors or manage power flow and the systems operators use to monitor them.

CISA says it has not received reports of public exploitation specifically targeting these seven flaws as of the advisory’s release. The vulnerabilities were reported to the agency by Gabrianna (Ria) Milloway of Idaho National Laboratory. Red Lion’s parent, HMS Networks, has issued its own advisory on the issue.

What operators can do now

Red Lion recommends upgrading affected N-Tron 700 Series devices to firmware version 3.11.1 or later, along with configuring or disabling SNMP communities and disabling access to the switch’s web management interface where it is not needed, according to CISA’s advisory. Beyond the vendor fix, CISA’s standard guidance for control system devices applies here: keep these devices off the open internet, and put a firewall between the control network and the corporate IT network so the two stay separate.

Where remote access to these switches is necessary, CISA recommends secure methods such as virtual private networks, while cautioning that VPN software has its own history of vulnerabilities and needs to be kept current. For plant and utility operators, the practical sequence is to inventory which N-Tron 700 Series switches are in service, confirm firmware and bootloader versions against the affected list, and schedule the upgrade with the same change-control discipline used for any other control-system modification, rather than applying it to a live process network without testing.

Part of a longer pattern

This is not the first security problem tied to Red Lion’s industrial networking lines. In 2015, ICS-CERT, CISA’s predecessor unit, disclosed hardcoded SSH and HTTPS keys in the N-Tron 702-W wireless access point. A 2020 SEC Consult advisory found a hidden root-level web-shell interface in the 702-W and 702M12-W models, products the vendor says are used in water, wastewater and energy systems and can no longer be updated; Red Lion recommends replacing that discontinued hardware outright rather than patching it.

Researchers have also disclosed two maximum-severity vulnerabilities, each scoring CVSS 10.0, in Red Lion’s Sixnet SixTRAK and VersaTRAK remote terminal units, which allowed unauthenticated attackers to run commands with root-level privileges, according to The Hacker News. Utilities, water treatment plants, transit systems and factories all run those RTUs somewhere in their operations. N-Tron products themselves, now folded under the Red Lion brand after a 2010 acquisition and 2013 consolidation, are deployed in more than 50 countries across energy, nuclear, transportation and water/wastewater sectors.

Red Lion is committed to providing our customers with reliable, secure industrial networking devices, and will address this issue with the highest priority

Red Lion Controls spokesperson, SecurityWeek

That statement, made in response to an earlier N-Tron flaw, points to a recurring dynamic across this vendor’s product lines: authentication and privilege-escalation weaknesses surface in one device family, get fixed or mitigated, and then resurface in another. For operators running N-Tron switches, the current advisory is a reminder to treat network segmentation and firmware tracking as ongoing maintenance rather than a one-time project.