CVE-2026-29797: CWE-494 in Red Lion Controls 700 Series

The vulnerability identified as CVE-2026-29797 in Red Lion Controls 700 Series devices involves the lack of authentication required for updating firmware or bootloader components. This flaw allows unauthorized users to push malicious firmware to the device. Furthermore, attackers possessing the same software can scan networks for N-Tron devices and perform firmware push or pull operations via SNMP and TFTP protocols without any authentication. This represents a significant risk of unauthorized firmware manipulation.

The vulnerability allows unauthorized modification of device firmware or bootloader, potentially leading to device compromise or malicious code execution. The lack of authentication on firmware updates and network scanning capabilities increases the risk of unauthorized access and manipulation of device software. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to management interfaces of affected devices and monitor for unauthorized firmware update attempts. Consider network segmentation to limit exposure of these devices.