CVE-2026-28745: CWE-257 in Red Lion Controls 700 Series

This vulnerability (CVE-2026-28745) in Red Lion Controls 700 Series involves weak encryption of usernames and passwords stored in configuration files. Default credentials are also stored using this weak encryption, which could enable an attacker who knows these default credentials to extract other credentials from the system. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

An attacker with knowledge of the default credentials could leverage the weak encryption to obtain additional credentials from the configuration file. While confidentiality and integrity impacts are not indicated, the vulnerability results in a high impact on availability, potentially disrupting device operation or causing denial of service.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to configuration files and change default credentials to unique, strong passwords to reduce risk.