CVE-2026-33367: CWE-306 in Red Lion Controls 700 Series

This vulnerability (CVE-2026-33367) affects Red Lion Controls 700 Series devices and involves improper access control (CWE-306) in the SNMP service. The SNMP interface permits administrative operations such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades without requiring any authentication. This lack of authentication enables attackers with network access to perform critical administrative actions remotely.

Successful exploitation allows an attacker with network access to fully control device configuration and firmware, potentially leading to device compromise or disruption. Confidentiality and integrity impacts are high, as attackers can access sensitive configuration data and modify device settings. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict network access to the SNMP service to trusted management networks only and monitor for unauthorized SNMP activity.