CVE-2026-33272: CWE-288 in Red Lion Controls 700 Series

This vulnerability (CWE-288) in Red Lion Controls 700 Series switches allows an attacker with physical access to bypass authentication by booting the device from factory settings. The attacker can then use default administrative credentials to obtain administrative privileges and save configuration changes that persist after reboot. The CVSS 3.1 base score is 4.9, reflecting medium severity with low attack vector (physical), low attack complexity, and no user interaction required. Confidentiality impact is low, integrity impact is high, and availability is unaffected.

An attacker with physical access can gain administrative control over the device by bypassing authentication and using default credentials. This enables unauthorized configuration changes that persist across reboots, potentially compromising device integrity. Confidentiality impact is limited, and availability is not affected.

No patch or official fix is currently documented. Since the vulnerability requires physical access and default credentials, mitigation includes restricting physical access to devices and changing default administrative credentials immediately upon deployment. Monitor vendor advisories for updates or patches.